North Korea Accounts for 76% of 2026 Crypto Theft, Total Stolen Since 2017 Exceeds $6 Billion

North Korean state-backed hackers stole $577 million in cryptocurrency during the first four months of 2026, representing 76% of all global crypto hack losses and continuing a dramatic escalation from below 10% in 2020-2021. TRM Labs reports the regime has now stolen over $6 billion since 2017, with two April 2026 attacks—the $292 million KelpDAO exploit and $285 million Drift Protocol hack—accounting for the bulk of recent losses. The attacks demonstrate increasingly sophisticated tactics: the Drift hack involved months of in-person social engineering to compromise multisig signers before executing 31 pre-signed withdrawals in 12 minutes, while KelpDAO attackers exploited single-verifier bridge design by compromising RPC infrastructure. North Korean groups now prioritize fewer, higher-impact attacks on bridges and cross-chain systems, with Chinese intermediaries handling laundering through platforms like THORChain to convert stolen assets into Bitcoin.

North Korea's Growing Dominance in Cryptocurrency Theft

• ▪North Korean cryptocurrency theft represented 76% of all global cryptocurrency hack losses during the first four months of 2026
• ▪Cumulative cryptocurrency theft attributed to North Korea exceeds $6 billion since 2017
• ▪North Korea's share of global crypto hack losses was 37% in 2023
• ▪The $1.46 billion Bybit breach in 2025 was a key inflection point in North Korea's recent cryptocurrency theft activity profile
• ▪North Korean actors extracted approximately $577 million through the first four months of 2026
• ▪North Korea's share of global crypto hack losses rose from below 10% in 2020 and 2021 to 22% in 2022

Technical Details of the 2026 KelpDAO and Drift Protocol Attacks

• ▪The Drift Protocol attack in April 2026 resulted in losses of $285 million
• ▪The KelpDAO exploit and Drift Protocol attack accounted for 3% of total hack incidents in 2026 through April
• ▪Drift Protocol migrated its Security Council to a new 2/5 threshold configuration with zero timelock days before the April 1, 2026 attack
• ▪The Drift Protocol attacker deployed 31 pre-signed withdrawals on April 1, 2026 to drain funds
• ▪The KelpDAO exploit in April 2026 resulted in losses of $292 million
• ▪Staging of the Drift Protocol attack began as early as March 11, 2026