North Korean hackers steal record $635M crypto

TLDR

North Korean state-linked hackers have been blamed for roughly $635 million in crypto stolen in a single month, making it one of the largest concentrated hack waves on record.

1. April 2026 saw about 29 breaches totaling over $635 million, with the Lazarus Group linked to most of the losses via major DeFi exploits.
2. The hacks hit protocols like KelpDAO and Drift, showing how social engineering and bridge flaws can cascade through DeFi and impact users far beyond the initial targets.
3. Authorities and protocols are tightening monitoring and governance, but users still face elevated smart contract and custody risk from increasingly sophisticated, state-backed attackers.

Deep Dive

1. What Happened In The $635M Wave

Reports describe April 2026 as a record month, with 29 crypto security incidents causing more than $635 million in losses, largely from the Drift Protocol and KelpDAO exploits attributed to North Koreas Lazarus Group. One analysis estimates Lazarus was behind about 95 percent of these incidents, making this a highly concentrated campaign rather than many unrelated hacks, and frames it as part of North Koreas strategy to fund its weapons programs via cyber thefts from crypto protocols. Other research notes that since 2017, North Korean groups have stolen over $6 billion in crypto, and that they already account for a majority of total crypto hack losses in 2026 through April.

2. How DeFi And Bridges Were Hit

KelpDAO reportedly lost around $290 million after attackers exploited a LayerZero bridge design flaw, then laundered funds through networks like THORChain, while Drift Protocol suffered a roughly $285 million exploit following months of social engineering to gain signer control. Analyses show DeFi projects absorbed over $600 million of Aprils losses, with wallet compromises and governance key abuse dominating, and smaller incidents at projects such as Rhea Finance and others filling out the total. The KelpDAO and Drift hits also impacted downstream protocols that relied on them for yield or collateral, in some cases forcing shutdowns or emergency deleveraging when TVL collapsed.

3. What To Watch Next For Users And Markets

Regulators and analytics firms are tracking North Korean activity more closely, and US, UK and South Korean agencies are reinforcing cyber defenses, but enforcement is reactive and often lags new techniques like long-horizon social engineering. Onchain, DAOs and bridges are rethinking admin key setups, multisig policies and incident playbooks after seeing how centralized control points can be abused or frozen during legal disputes over recovered funds. For individual users and funds, the practical risk is higher tail risk in DeFi: even audited protocols with strong brands can suffer catastrophic exploits that ripple into dependent apps, collateral markets and token prices.

Conclusion

North Korean-linked hackers driving a $635 million hack month underscores how a small number of highly skilled groups can impose outsized losses on crypto. The immediate impact is concentrated in DeFi and bridges, but the broader effect is persistent risk premia on smart contract platforms and closer regulatory scrutiny. Going forward, the key variables are whether protocols harden governance and operational security faster than attackers evolve, and how much additional pressure regulators put on cross-chain and high-yield DeFi exposures.