North Korean hackers stole $643 million in cryptocurrency in the first half of 2026, representing 66% of the $972 million lost globally. This haul was driven by two major April attacks: a $285 million social engineering exploit on Drift Protocol and a $292 million bridge exploit on KelpDAO. Since 2017, North Korean state-backed groups have stolen over $6 billion in crypto, funneling proceeds into the regime's nuclear weapons program while exploiting decentralized finance vulnerabilities.
North Korean H1 2026 theft
- ▪The $643 million stolen by North Korean hackers accounted for 66% of the $972 million total lost to global cryptocurrency theft in the first half of 2026
- ▪North Korean hackers stole $643 million in cryptocurrency during the first six months of 2026
- ▪Global cryptocurrency theft in the first half of 2026 totaled $972 million across 207 incidents, down from $2.3 billion in the first half of 2025
Drift Protocol April attack
- ▪On April 1, 2026, attackers compromised protocol signers to steal approximately $285 million from Drift Protocol in about 12 minutes
- ▪The Drift Protocol attack was executed using social engineering techniques to compromise protocol signers
KelpDAO bridge exploit
- ▪On April 18, 2026, KelpDAO was exploited for approximately $292 million through a LayerZero bridge exploit
- ▪The KelpDAO exploit was attributed to TraderTraitor, a known Lazarus subgroup specializing in targeting cross-chain infrastructure
Lazarus Group evolution
- ▪North Korean operators launder stolen cryptocurrency through bridges, mixing services, and other obfuscation techniques to make tracing and freezing assets difficult
- ▪The Lazarus Group has evolved over nine years from crude exchange hacks into a sophisticated operation deploying custom malware, supply chain compromises, and social engineering
DeFi protocol security vulnerabilities
- ▪The concentration of cryptocurrency losses in decentralized finance protocols and bridge infrastructure highlights vulnerabilities in signer security and bridge architecture
- ▪Security experts recommend that investors evaluate multisig configurations, signer operational security, and security audits modeling state-sponsored threats before committing funds to decentralized finance protocols
North Korea cumulative crypto theft
- ▪Stolen cryptocurrency proceeds from North Korean cyber operations are funneled toward the regime's nuclear weapons program
- ▪North Korean state-backed groups have accumulated over $6 billion in cryptocurrency thefts since 2017
Story comments
Loading comments…