North Korea hackers drive 76% crypto thefts

TLDR

North Korea linked hacking groups are currently responsible for the majority of value stolen in crypto hacks, driven by two very large DeFi exploits in early 2026.

1. TRM Labs estimates North Korea related actors took about 76 percent of all crypto hack losses in 2026 through April, roughly 577 million dollars, mainly from Drift and KelpDAO hacks.
2. Their share of global crypto theft has climbed from under 10 percent in 2020 to 76 percent in early 2026, as they focus on fewer, highly sophisticated attacks on DeFi and cross chain bridges.
3. The main risks for users are protocol and bridge security and potential tighter sanctions enforcement, so watching DeFi security design and laundering chokepoints matters more than individual wallet hygiene alone.

Deep Dive

1. What The 76 Percent Figure Means

Blockchain intelligence firm TRM Labs reports that organizations linked to North Korea accounted for about 76 percent of global crypto hack losses in the first four months of 2026, or around 577 million dollars in stolen assets. That concentration comes almost entirely from two April exploits: a roughly 285 million dollar breach of Solana based Drift Protocol and a roughly 292 million dollar exploit of KelpDAOs rsETH bridge, together representing only about 3 percent of incidents but nearly three quarters of value lost so far this year.[\[source\]](https://crypto.news/trm-labs-north-korea-linked-hackers-drive-76-of-2026-crypto-thefts/)

Other reporting from TRM cited by Decrypt and Yahoo Finance similarly puts North Korea linked cumulative crypto theft at over 6 billion dollars since 2017, confirming that these are not isolated events but part of a long running campaign that now dominates the loss statistics.[\[source\]](https://decrypt.co/366241/north-korean-hackers-stolen-6-billion-crypto-trm)

2. How North Korea Hacks Crypto

Analysts describe a strategy of relatively few attacks with very large payouts rather than constant small thefts. North Koreas share of global crypto hack losses has risen from under 10 percent in 2020 and 2021 to 22 percent in 2022, 37 percent in 2023, 39 percent in 2024, 64 percent in 2025 and 76 percent in early 2026, the highest sustained share on record.[\[source\]](https://finance.yahoo.com/markets/crypto/articles/north-korean-hackers-stolen-6-184253106.html)

The Drift hack combined months of social engineering and operational compromise with a targeted use of a Solana feature called a durable nonce to execute 31 withdrawals in about 12 minutes, draining assets like USDC and jupiter-perps-lp/">JLP.[\[source\]](https://decrypt.co/366241/north-korean-hackers-stolen-6-billion-crypto-trm) The KelpDAO attack abused a single verifier bridge design by poisoning internal infrastructure, then forcing reliance on falsified data, to release over 116,000 rsETH from an Ethereum bridge contract.[\[source\]](https://finance.yahoo.com/markets/crypto/articles/north-korean-hackers-stolen-6-184253106.html)

TRM analysts also speculate that North Korean operators may now be using AI tools to improve reconnaissance and social engineering, which would help explain the increasing precision of these operations.[\[source\]](https://finance.yahoo.com/markets/crypto/articles/north-korea-claims-76-2026-025607513.html)

3. Why It Matters For Crypto Users

These events highlight that the biggest tail risks in crypto often sit at the protocol and bridge layer, especially in DeFi and restaking ecosystems, rather than in individual user wallets. Large exploits like Drift and KelpDAO can hit token prices, drain liquidity and trigger broader DeFi deleveraging when collateral gets compromised.[\[source\]](https://crypto.news/trm-labs-north-korea-linked-hackers-drive-76-of-2026-crypto-thefts/)

Regulators and law enforcement are likely to respond by tightening expectations on exchanges, bridges and infrastructure providers, including more aggressive freezing of stolen funds and higher compliance costs at on and off ramps. That can reduce laundering options for attackers but can also affect user experience and capital flows, particularly in privacy sensitive or cross chain use cases.

Conclusion

North Korea linked groups dominate current crypto theft totals because they specialize in rare but extremely large DeFi and bridge exploits, not because all of crypto is overrun by everyday hacks. For users and builders, the lesson is that systemic risk now clusters in protocol design, governance and infrastructure dependencies, and that security choices at that level can matter far more than any one wallets opsec.