North Korean Actors Extract $577M in Crypto Hacks Through April 2026, Accounting for 76% of Global Losses

According to TRM Labs, North Korean actors extracted approximately $577 million in the first four months of 2026, representing 76% of all global cryptocurrency hack losses during the period. The theft stems from two April incidents: the $292 million KelpDAO exploit and the $285 million Drift Protocol attack. TRM attributed the KelpDAO breach to TraderTraitor, a Lazarus-affiliated operation, while the Drift attack involved a separate North Korean subgroup. The Drift hack employed months of in-person coordination with Drift employees, culminating in a rapid 12-minute fund drainage on April 1 after attackers pre-authorized transactions through a compromised Security Council multisig. The KelpDAO attack exploited a single-verifier design in a LayerZero bridge by compromising RPC infrastructure, draining approximately 116,500 rsETH.

North Korea’s share of global crypto hack losses has accelerated significantly, rising from below 10% in 2020–2021 to 64% in 2025. Cumulative attributed theft now exceeds $6 billion since 2017, with TRM noting that elite North Korean groups are prioritizing fewer but higher-impact attacks targeting bridges and cross-chain infrastructure.