- In 2026, North Korean hacker groups were responsible for 76% of global crypto market losses.
- Two major hacks in April on KelpDAO and Drift Protocol resulted in losses of approximately $577 million.
- Since 2017, North Korea has stolen over $6 billion through crypto-related attacks.
- Their strategy has shifted towards fewer attacks with larger financial impacts.
- The focus is on vulnerabilities in bridges, multisignatures, and cross-chain infrastructures.
North Korean Hackers Dominate Crypto Losses in 2026
North Korean hacker groups have become a dominant force in the world of cryptocurrency cybercrime. According to TRM Labs, these groups accounted for about 76% of all crypto hack losses in the early months of 2026. This astonishing figure translates to roughly $577 million lost due to their activities.
Major Hacks: KelpDAO and Drift Protocol
The staggering losses stem from just two significant breaches that occurred in April. The first attack targeted KelpDAO, resulting in a loss of $292 million. This incident involved the TraderTraitor group, which is linked to the notorious Lazarus ecosystem. The second breach hit Drift Protocol with a $285 million theft. While details remain scarce, this second attack is also believed to be linked to North Korean hackers.
Sophisticated Attack Techniques
Experts have noted that these attacks demonstrated advanced planning and execution. The Drift Protocol breach involved social engineering and technical prowess, allowing attackers to pre-sign transactions and swiftly move funds within minutes. These funds were subsequently transferred into the Ethereum network.
Meanwhile, the attack on KelpDAO exploited a vulnerability within LayerZero’s cross-chain infrastructure. By compromising nodes and manipulating validation mechanisms, attackers siphoned off over 116,000 rsETH. A portion of these funds was laundered through interchain services like THORChain.
Increasing Share of Global Crypto Heists
North Korea’s share in global cryptocurrency thefts has been steadily increasing. From less than 10% between 2020 and 2021, their involvement rose to 64% by 2025 and reached an alarming 76% by 2026. Since 2017, they have amassed over $6 billion through such illicit activities.
TRM Labs reports that North Korean strategies are evolving towards fewer but more lucrative heists. They target bridges, multisignatures, and cross-chain infrastructures where architectural flaws can yield maximum profit.
A Broader Impact on the Crypto Market
These developments underscore the growing sophistication and audacity of state-sponsored hacking operations targeting cryptocurrencies. With North Korea shifting its focus towards high-value targets using advanced tactics, the crypto industry faces increasing pressure to bolster security measures against such threats.
As we observe these trends unfold, it is crucial for stakeholders within the crypto ecosystem—from developers to regulatory bodies—to enhance defenses against increasingly complex cyber threats that could destabilize markets globally without prompt intervention.
