North Korean state-linked hackers accounted for 76% of all cryptocurrency stolen in 2026 through just two attacks worth $577 million.
Key Points:
- North Korea accounted for 76% of all crypto stolen in 2026, draining $577 million in two attacks.
- April losses hit $629.69 million, the worst single month on record, with DeFi protocols bearing the brunt.
- Year-to-date theft reached $771.8 million across 47 incidents, up 68% in frequency over 2025.
North Korea Crypto Heists
Blockchain intelligence firm TRM Labs reported that two breaches drove nearly all of the year's losses. The attackers drained $285 million from Drift Protocol, built on Solana (SOL), on Apr. 1, then took $292 million from the KelpDAO bridge 17 days later. Both heists trace back to North Korean operatives.
Those two strikes made up just 3% of recorded incidents this year, yet they swallowed 76% of the stolen value. April became the worst month in crypto history, with $629.69 million drained and $614.17 million of it from DeFi protocols, pushing the year's tally to $771.8 million across 47 incidents.
Also Read: Cardano Tops Every Major Chain In Stablecoin Growth, Up 61% In A Week
DeFi Bridge Exploits
The pattern marks a shift toward fewer but larger raids on cross-chain infrastructure and multisig controls, even as the raw count of incidents jumps 68% over last year. The Drift breach grew out of a six-month social engineering push that planted operatives inside the project. The Kelp exploit, by contrast, abused a single-verifier flaw in a cross-chain bridge.
Stolen funds moved fast.
The crews routed roughly $175 million in Ether (ETH) through the THORChain network, then converted it to Bitcoin (BTC) without any operator stepping in to halt the flow. The KelpDAO breach also sparked a bank run on Aave (AAVE), whose total value locked tumbled by billions within a day. Since 2017, North Korea has now pulled more than $6 billion from crypto projects.
Analysts say the concentration should worry the wider market even as raw attack counts stay flat. Researcher Ted Pillows warned that the damage now spreads system-wide, noting that "every protocol is taking a hit now." Across 2025, stolen credentials, social engineering, and supply chain hits drove roughly three-quarters of all crypto losses, a clear pivot away from buggy code toward human targets.
Bybit Breach Legacy
North Korea's grip on crypto theft has tightened for years, with its share of global losses climbing from 22% in 2022 to 64% in 2025. The $1.5 billion Bybit raid that February still stands as the largest single crypto theft on record, and its playbook now repeats at protocol level.
Read Next: ETH Loses Its Last Floor And Stares Down A Drop Toward $1,800
