North Korea steals $643M in cryptocurrency in first half of 2026, accounting for 66% of global crypto theft

North Korean hackers stole $643 million in cryptocurrency in the first half of 2026, representing 66% of the $972 million lost globally. This haul was driven by two major April attacks: a $285 million social engineering exploit on Drift Protocol and a $292 million bridge exploit on KelpDAO. Since 2017, North Korean state-backed groups have stolen over $6 billion in crypto, funneling proceeds into the regime's nuclear weapons program while exploiting decentralized finance vulnerabilities.

North Korean H1 2026 theft

• ▪The $643 million stolen by North Korean hackers accounted for 66% of the $972 million total lost to global cryptocurrency theft in the first half of 2026.
• ▪North Korean hackers stole $643 million in cryptocurrency during the first six months of 2026.
• ▪Global cryptocurrency theft in the first half of 2026 totaled $972 million across 207 incidents, down from $2.3 billion in the first half of 2025.

Drift Protocol April attack

• ▪On April 1, 2026, attackers compromised protocol signers to steal approximately $285 million from Drift Protocol in about 12 minutes.
• ▪The Drift Protocol attack was executed using social engineering techniques to compromise protocol signers.

KelpDAO bridge exploit

• ▪On April 18, 2026, KelpDAO was exploited for approximately $292 million through a LayerZero bridge exploit.
• ▪The KelpDAO exploit was attributed to TraderTraitor, a known Lazarus subgroup specializing in targeting cross-chain infrastructure.

Lazarus Group evolution

• ▪North Korean operators launder stolen cryptocurrency through bridges, mixing services, and other obfuscation techniques to make tracing and freezing assets difficult.
• ▪The Lazarus Group has evolved over nine years from crude exchange hacks into a sophisticated operation deploying custom malware, supply chain compromises, and social engineering.

DeFi protocol security vulnerabilities

• ▪The concentration of cryptocurrency losses in decentralized finance protocols and bridge infrastructure highlights vulnerabilities in signer security and bridge architecture.
• ▪Security experts recommend that investors evaluate multisig configurations, signer operational security, and security audits modeling state-sponsored threats before committing funds to decentralized finance protocols.

North Korea cumulative crypto theft

• ▪Stolen cryptocurrency proceeds from North Korean cyber operations are funneled toward the regime's nuclear weapons program.
• ▪North Korean state-backed groups have accumulated over $6 billion in cryptocurrency thefts since 2017.

2 sources