North Korean hackers accounted for 76% of all cryptocurrency hack losses through April, according to TRM Labs.
The report revealed that hackers from two different groups stole approximately $577 million through two attacks in 2026.
Two robberies in North Korea accounted for 76% of cryptocurrency hack losses in 2026
The Drift protocol was hacked and the KelpDAO bridge was exploited in the same month. Together they accounted for just 3% of this year’s incidents, but they account for the bulk of the value stolen. It is worth noting that both hacks are attributed to North Korean actors.
“North Korean hacking groups accounted for 76% of all cryptocurrency hack losses in 2026 through April — not because North Korea launched a wave of attacks, but because two attacks totaling $577 million dwarfed everything else,” TRM Labs wrote.
The April 1 Drift exploit cost the Solana-based Permanent Exchange $285 million. In a Incident follow-up reportThe Drift Team noted that the attack was the result of a six-month-long intelligence operation linked to North Korean actors. The repercussions reached beyond drift, Impact on many protocols.
Among them was the Solana platform, which belongs to the islands. The team announced its closure on April 30. Carrot has set May 14 as the last deadline for users to withdraw remaining balances from Boost, Turbo and CRT positions before forced deleveraging begins.
Follow us on X To get the latest news as it happens
Meanwhile, on April 18, attackers drained 116,500 rsETH, worth approximately $292 million, from the cross-chain KelpDAO bridge. This has become the biggest DeFi hack so far this year.
Investigations indicated that the traitorous merchant affiliated with the Lazarus Group He was a potential actor Behind the hack. The consequences spread throughout space. Aave and the broader DeFi TVL declined sharply after Exploitation.
North Korea’s share of cryptocurrency theft continues to rise
North Korean groups have become the dominant force in cryptocurrency theft. They drained at least $2.02 billion in digital assets During the year 2025 alone.
Its share of total breach losses has risen sharply in recent years. The number remained less than 10% in 2020 and 2021, then increased to 22% in 2022, then reached 37%, 39%, and 64% in the following years. The 76% reading through April 2026 represents an all-time sustainable high.
TRM analysts noted that the attack frequency has not increased. Pyongyang’s major hacking teams still run a small number of carefully selected operations each year, favoring precision over scale.
What has changed is the “complexity of attacks.” TRM suggests that North Korean operators may be incorporating AI tools into reconnaissance and social engineering operations.
“TRM analysts have begun to speculate that North Korean operators are incorporating artificial intelligence tools… a development consistent with the increasing precision of attacks like Drift, which require weeks of targeted manipulation of complex blockchain mechanisms, rather than North Korea’s traditional focus on simple private key compromises,” the report said.
This development raises pressing questions about AI-based attack capabilities and whether cryptographic protocols can keep up This new threat vector.
Subscribe to our YouTube A channel to watch leaders and journalists provide expert insights
this post North Korea claims 76% of 2026 cryptocurrency hack losses in just four months appeared first on BeInCrypto.
