TLDR
North Korea linked hacking groups now account for roughly three quarters of all value stolen in crypto hacks this year, driven by a few very large DeFi exploits.
- TRM Labs reports DPRK linked hackers took about 76% of global crypto hack losses in early 2026, roughly 577 to 600 million dollars, mostly from two nine figure exploits.
- These groups combine months long social engineering, insider style access, and sophisticated bridge and DeFi attacks, then launder funds through cross chain routes like THORChain.
- For crypto users, the main impact is higher perceived tail risk in DeFi and restaking, stricter compliance on bridges and exchanges, and more scrutiny of hiring and access controls.
Deep Dive
1. What 76% Of Theft Really Means
TRM Labs finds that North Korea linked actors were responsible for about 76% of all crypto hack value in 2026 through April, around 577 million dollars, despite making only a small share of total incidents. Reports from Decrypt and CoinDesk note that two attacks dominate this figure, a roughly 285 million dollar exploit of Drift Protocol on Solana and a 292 million dollar exploit of KelpDAO on Ethereum, both attributed to DPRK or Lazarus groups. Since 2017, cumulative losses tied to North Korea have exceeded 6 billion dollars, with their share of hack value rising from under 10% in 2020 to 64% in 2025 and now 76% in 2026.
A handful of state backed operations are responsible for most of the financial damage, so risk is highly concentrated in a few very capable threat actors.
2. How DPRK Hackers Operate
Investigations describe a shift from pure remote exploits to human centric operations. In the Drift case, North Korean proxies reportedly cultivated relationships and met employees in person over months before triggering the drain. For KelpDAO, attackers compromised internal RPC nodes and abused a single verifier bridge design to forge cross chain messages, then laundered roughly 175 million dollars through THORChain after part of the funds were frozen on Arbitrum. Earlier research also shows DPRK IT workers embedded in dozens of crypto projects, using fake identities to gain code and infrastructure access, which then feeds into large protocol level exploits.
Technical audits alone are not enough, because compromised staff, keys, or infrastructure can bypass otherwise solid smart contracts.
3. Implications For Users And Protocols
For individual users, the practical risk is highest when interacting with complex DeFi protocols, restaking platforms, and bridges, where a single infrastructure failure can erase hundreds of millions of dollars of value. For teams, the pattern argues for stricter hiring checks, device and key management, multisig and timelock use, and diversified infrastructure rather than single verifiers or single operators. At the market level, repeated DPRK linked mega hacks increase perceived tail risk, can trigger short term deleveraging across DeFi, and are likely to accelerate regulatory pressure on exchanges, OTC desks, and cross chain routers that are used for laundering.
Users who want exposure to DeFi may need to weigh yields against protocol and bridge design, while teams must treat insider and infrastructure security as critical as contract code.
Conclusion
North Korea linked hacking groups have evolved into the dominant source of loss in crypto hacks, not by attacking more often, but by executing a few very large, well prepared operations. Their success hinges on blending social engineering, insider access, and technical flaws in bridges and DeFi infrastructure, then leveraging global liquidity rails to launder proceeds. For the broader crypto ecosystem, this trend forces a shift toward stronger operational security, more conservative bridge and governance designs, and closer scrutiny from regulators and institutional participants.
CoinsKid.Com