North Korea Accounts for 76% of 2026 Crypto Theft, Total Stolen Since 2017 Exceeds $6 Billion

May 1, 2026

North Korean state-backed hackers stole $577 million in cryptocurrency during the first four months of 2026, representing 76% of all global crypto hack losses and continuing a dramatic escalation from below 10% in 2020-2021. TRM Labs reports the regime has now stolen over $6 billion since 2017, with two April 2026 attacks—the $292 million KelpDAO exploit and $285 million Drift Protocol hack—accounting for the bulk of recent losses. The attacks demonstrate increasingly sophisticated tactics: the Drift hack involved months of in-person social engineering to compromise multisig signers before executing 31 pre-signed withdrawals in 12 minutes, while KelpDAO attackers exploited single-verifier bridge design by compromising RPC infrastructure. North Korean groups now prioritize fewer, higher-impact attacks on bridges and cross-chain systems, with Chinese intermediaries handling laundering through platforms like THORChain to convert stolen assets into Bitcoin.

North Korea's Growing Dominance in Cryptocurrency Theft

▪North Korean cryptocurrency theft represented 76% of all global cryptocurrency hack losses during the first four months of 2026.
▪Cumulative cryptocurrency theft attributed to North Korea exceeds $6 billion since 2017.
▪North Korea's share of global crypto hack losses was 37% in 2023.
▪The $1.46 billion Bybit breach in 2025 was a key inflection point in North Korea's recent cryptocurrency theft activity profile.
▪North Korean actors extracted approximately $577 million through the first four months of 2026.
▪North Korea's share of global crypto hack losses rose from below 10% in 2020 and 2021 to 22% in 2022.

Technical Details of the 2026 KelpDAO and Drift Protocol Attacks

▪The Drift Protocol attack in April 2026 resulted in losses of $285 million.
▪The KelpDAO exploit and Drift Protocol attack accounted for 3% of total hack incidents in 2026 through April.
▪Drift Protocol migrated its Security Council to a new 2/5 threshold configuration with zero timelock days before the April 1, 2026 attack.
▪The Drift Protocol attacker deployed 31 pre-signed withdrawals on April 1, 2026 to drain funds.
▪The KelpDAO exploit in April 2026 resulted in losses of $292 million.
▪Staging of the Drift Protocol attack began as early as March 11, 2026.