The decentralized exchange Stabble has instructed its users to withdraw liquidity, causing its total value locked (TVL) to plummet by 62% on Tuesday. This drastic reduction followed revelations that the platform’s former chief technology officer had been identified as a purported North Korean hacker.
Under new management, Stabble began the day with approximately $1.75 million in TVL, according to DeFiLlama data. After issuing an emergency warning, the TVL decreased to under $663,000.
“EMERGENCY!” declared the newly appointed team on X. “Guys, please temporarily withdraw your liquidity instantly! Better safe than sorry.”
The alert was disseminated via social media at 9:34 a.m. ET on Tuesday, nearly seven hours after ZachXBT, an anonymous blockchain investigator, reported that Keisuke Watanabe—a purported North Korean hacker—had previously served as Stabble’s CTO.
Despite no known vulnerabilities being disclosed, the firm announced plans to conduct audits for enhanced security measures.
“We received a message and are acting on it; our primary focus is ensuring the safety of our liquidity providers,” stated the new team. “Our expertise lies in quantitative analysis and early DeFi development, not public relations. We value your feedback.”
This swift action by Stabble follows a recent major security breach at Drift, another Solana-based DeFi protocol, where hackers allegedly linked to North Korea siphoned over $285 million.
In what was described as an elaborate and sophisticated scheme lasting six months, these attackers reportedly used fake identities and in-person meetings before employing malicious tools to drain funds. The connection between North Korean actors and on-chain exploits remains a persistent issue. Last year, hackers from North Korea executed the largest crypto heist on record by targeting Bybit for $1.4 billion. Furthermore, Binance’s chief security officer has indicated that individuals believed to be from North Korea attempt daily recruitment within their ranks.
In response to these growing threats, the Solana Foundation announced several new security initiatives earlier in the week aimed at protecting DeFi protocols with a TVL of at least $10 million.