TLDR
North Korea-linked hacking groups are responsible for roughly 76% of all crypto hack losses so far in 2026, according to new research.
- TRM Labs estimates North Korea-linked actors stole about $577600 million in 2026 to date, roughly 76% of global crypto hack losses, and over $6 billion since 2017.
- This dominance comes mainly from a few very large DeFi exploits, including the Drift Protocol and KelpDAO hacks, using sophisticated social engineering and infrastructure attacks.
- The concentration of losses in DeFi and bridges raises security and regulatory pressure on protocols and exchanges, and increases tail risk for all crypto users.
Deep Dive
1. What The 76% Figure Actually Means
Blockchain intelligence firm TRM Labs reports that organizations linked to North Korea account for around 76% of global crypto hack losses in the first four months of 2026, or about $577 million, with cumulative takings since 2017 above $6 billion. This is a sharp rise from 22% in 2022 and 64% in 2025, making North Korea the dominant single source of on chain theft today. Crypto media summarizing the report, including outlets such as crypto.news and CoinDesk, confirm these figures and the state-linked nature of the main groups.
The headline is about share of losses in 2026 so far, not all crime in crypto, but it still shows a very high concentration of successful hacks in one state-backed cluster.
2. How North Korea-Linked Groups Are Hacking DeFi
The 2026 number is driven mainly by two huge April exploits. Reports cite a roughly $285 million theft from Drift Protocol and a roughly $292 million exploit of KelpDAO, together making up 76% of all tracked hack losses this year, despite being only a small fraction of incidents. Investigations describe months-long in-person social engineering against Drift staff plus technical abuse of Solana features and compromised admin keys, while the KelpDAO attack used poisoned RPC infrastructure and a single-verifier bridge design. Earlier and related campaigns show a pattern of converting stolen funds to stablecoins, bridging to Ethereum, then routing through mixers and cross-chain protocols such as THORChain to evade sanctions screening.
The biggest risk is not many small bugs, but a few highly resourced, patient operations that target key infrastructure and privileged access.
3. Why This Matters For Crypto Users And Markets
For DeFi and restaking protocols, these incidents highlight structural risks in bridge design, admin-key control, and off-chain infrastructure like RPC nodes, which can fail even if core contracts are audited. The KelpDAO incident alone reportedly triggered massive withdrawals from lending platforms and created large bad-debt holes, illustrating how a single exploit can shock liquidity and risk appetite across multiple ecosystems. Regulators and law enforcement are responding by increasing focus on sanctions evasion, mixers, and exchange compliance, which can raise operational costs and tighten surveillance across the industry.
Expect more scrutiny on cross-chain bridges, admin-key design and AML controls; for users, large TVL and blue chip branding do not eliminate smart contract and governance risk.
Conclusion
North Korea-linked hackers dominating 2026 hack losses reflects a shift toward fewer, larger and more sophisticated DeFi exploits rather than a simple rise in generic crime. That concentration of risk in bridges, restaking systems and privileged keys is now a core macro factor for digital assets, influencing regulation, liquidity and how both builders and users think about protocol security.
CoinsKid.Com