North Korea’s 2026 Crypto Heist: 76% of Losses in Just Four Months!

by

North Korea Claims 76% of 2026 Crypto Hack Losses in Just Four Months

TRM Labs reports that North Korean hackers were responsible for a staggering 76% of all cryptocurrency stolen through April of this year.

In 2026, hackers from two separate groups carried out attacks and stole approximately $577 million in total, according to the report.

2 North Korean Heists Drove 76% of 2026 Crypto Hack Losses

Both Drift Protocol and KelpDAO were hit by security incidents in the same month. While these two events made up only a small percentage of all incidents this year, they resulted in the majority of the total value stolen. Investigators believe these hacks were carried out by groups linked to North Korea.

According to TRM Labs, North Korean hacking groups were responsible for 76% of all cryptocurrency stolen in hacks through April 2026. This high percentage wasn’t due to a surge in attacks, but rather because just two separate hacks, totaling $577 million, significantly exceeded the losses from all other incidents.

On April 1st, a security breach called the Drift exploit resulted in losses of $285 million for the Solana-based perpetual exchange. According to a report from the Drift team, the attack was the result of a six-month intelligence gathering effort by hackers believed to be linked to North Korea. The impact of this breach extended beyond Drift itself, affecting multiple other projects and protocols.

Carrot, a platform for earning rewards on Solana, recently announced it will be closing down on April 30th. Users have until May 14th to withdraw any funds they have in Boost, Turbo, and CRT. After that date, the platform will automatically begin to close out leveraged positions.

Follow us on X to get the latest news as it happens

We’re very sorry to announce that Carrot is shutting down. Unfortunately, the recent Drift exploit created insurmountable challenges, making it impossible for us to continue operating.

— Carrot (@DeFiCarrot) April 30, 2026

On April 18th, hackers stole $292 million worth of rsETH (around 116,500 units) from KelpDAO’s bridge connecting different blockchains. This is the biggest theft reported in the decentralized finance (DeFi) space so far in 2024.

Investigations pointed to the Lazarus Group’s TraderTraitor as the most probable culprit behind the cyberattack. The impact of the hack was widespread, causing a significant drop in the total value locked (TVL) for Aave and the overall Decentralized Finance (DeFi) sector.

North Korea’s Share of Crypto Theft Keeps Climbing

North Korean hacking groups were responsible for the vast majority of cryptocurrency theft in 2025, stealing at least $2.02 billion in digital assets.

Over the past few years, the portion of total hacking losses attributed to this group has increased dramatically. It was less than 10% in both 2020 and 2021, but jumped to 22% in 2022. Since then, it’s continued to rise, reaching 37%, 39%, and 64% in subsequent years. Currently, at 76% as of April 2026, it represents the highest percentage ever recorded.

Analysts at TRM have observed that the number of cyberattacks hasn’t gone up. North Korea’s main hacking groups continue to focus on a few, well-planned operations annually, prioritizing accuracy and impact over launching a large number of attacks.

The attacks are becoming more advanced. TRM Labs believes North Korean hackers might be using artificial intelligence to gather information and trick people.

Security researchers at TRM Labs believe North Korean hackers are starting to use artificial intelligence. This shift aligns with increasingly sophisticated attacks, such as ‘Drift,’ which involved weeks of carefully manipulating blockchain technology—a departure from their usual method of simply stealing private keys.

This new development brings up important concerns about how artificial intelligence could be used for attacks, and whether cryptocurrency systems can adapt quickly enough to defend against this emerging threat.

Read More

2026-05-01 06:12