North Korea Claims 76% of 2026 Crypto Hack Losses in Just Four Months

North Korean hackers accounted for 76% of all crypto hack losses through April, according to TRM Labs.

The report revealed that hackers from two distinct groups stole roughly $577 million across two attacks in 2026.

2 North Korean Heists Drove 76% of 2026 Crypto Hack Losses

The Drift Protocol breach and the KelpDAO bridge exploit landed in the same month. Together, they accounted for just 3% of this year’s incident counts, but the bulk of the stolen value. Notably, both these hacks are attributed to North Korean actors.

“North Korean hacking groups accounted for 76% of all crypto hack losses in 2026 through April — not because North Korea launched a wave of attacks, but because two attacks totaling USD 577 million dwarfed everything else,” TRM Labs wrote.

The Drift exploit on April 1 cost the Solana-based perpetual exchange $285 million. In a follow-up incident report, the Drift team noted that the attack was the outcome of a six-month intelligence operation tied to North Korean actors. The fallout reached well beyond Drift, impacting several protocols.

Solana yield platform Carrot was among them. The team announced its shutdown on April 30. Carrot has set May 14 as the final deadline for users to withdraw remaining balances from Boost, Turbo, and CRT positions before forced deleveraging begins.

Follow us on X to get the latest news as it happens

Meanwhile, on April 18, attackers drained 116,500 rsETH, worth roughly $292 million, from KelpDAO’s cross-chain bridge. This has become the largest DeFi hack so far this year.

Investigations suggested that the Lazarus Group’s TraderTraitor was the likely actor behind the hack. The aftermath spread across the space. Aave and the broader DeFi TVL plunged sharply after the exploit.

North Korea’s Share of Crypto Theft Keeps Climbing

North Korean groups have become the dominant force in crypto theft. They drained at least $2.02 billion in digital assets during 2025 alone.

Their share of total hack losses has risen sharply over recent years. The figure sat below 10% in 2020 and 2021, climbed to 22% in 2022, then reached 37%, 39%, and 64% in the years that followed. The 76% reading through April 2026 marks the highest sustained level on record.

TRM analysts note that the attack frequency has not increased. Pyongyang’s top hacking teams still run a small number of carefully chosen operations each year, choosing precision over volume.

What has shifted is the “sophistication of the attacks.” TRM suggests that North Korean operators may be integrating AI tools into reconnaissance and social engineering operations.

“TRM analysts have begun to speculate that North Korean operators are incorporating AI tools…a development consistent with the increasing precision of attacks like Drift, which required weeks of targeted manipulation of complex blockchain mechanisms, rather than North Korea’s traditional emphasis on simple private key compromises,” the report read.

The development raises pressing questions about AI-driven attack capabilities and whether crypto protocols can keep pace with this new threat vector.

Subscribe to our YouTube channel to watch leaders and journalists provide expert insights

The post North Korea Claims 76% of 2026 Crypto Hack Losses in Just Four Months appeared first on BeInCrypto.