North Korea-Linked Hackers Dominate Crypto Hack Losses in 2026

North Korea-linked hackers have been behind a significant portion of cryptocurrency hacks in recent years, with new research from TRM Labs revealing that they accounted for 76% of all crypto hack losses in 2026 through April. The figure is not the result of dozens of smaller attacks, but rather two massive incidents that overwhelmed the rest of the year's exploit data.

The two incidents, which took place on April 1 and April 18, involved the Drift Protocol and KelpDAO exploits, respectively. The combined stolen value was approximately $577 million, with the Drift Protocol attack draining around $285 million in a highly coordinated operation likely linked to North Korean actors.

The KelpDAO exploit, which occurred on April 18, drained around $292 million in rsETH from KelpDAO's LayerZero-based bridge. The attack was attributed to the DPRK's Lazarus Group and had wider stress across DeFi due to the stolen assets interacting with lending markets and liquidity systems.

The incidents highlight the need for stronger transaction policies, better signer security, and more robust incident response plans in DeFi systems. They also underscore the growing sophistication of North Korean hackers, who are increasingly using social engineering and operational manipulation to achieve their goals.