North Korean Hackers Account for 76% of Crypto Losses in 2026

A recent report by TRMLabs reveals that North Korean state-backed hackers are responsible for 76% of all crypto scam and hack losses in 2026, totaling nearly $600 million. This brings their cumulative crypto theft to over $6 billion since 2017. The hackers, mainly from the DPRK and Lazarus groups, have been operating with increased sophistication and precision, with a notable example being the $285 million Drift Protocol exploit.

The Drift Protocol exploit involved an unprecedented in-person social engineering attack, where North Korean proxies met with Drift employees over several months. According to Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, this is a significant departure from the typical remote keyboard operations. The hackers converted the stolen funds to USDC, bridged to Ethereum, and swapped them into ETH, which has not been moved since the day of the theft.

The report also highlights the differences in tactics between the DPRK and Lazarus groups. While the DPRK took a more patient approach with the Drift exploit, Lazarus immediately laundered the proceeds from the $292 million KelpDAO breach through THORChain and Umbra. The KelpDAO exploit triggered a significant wipeout in DeFi, with $13 billion exiting several lending platforms, including Aave, which lost $8.54 billion in deposits over 48 hours.

The increasing sophistication and precision of North Korean hackers pose a significant threat to the crypto industry. As Redbord notes, North Korea is moving faster and more precisely than ever, with their cumulative crypto theft now exceeding $6 billion. The report's findings coincide with other notable exploits, including the Wasabi Protocol hack, which used a similar playbook to the Drift exploit.

The crypto industry is taking steps to mitigate these threats, with industry participants helping to alleviate the $200 million bad-debt crisis faced by Aave. However, the report's findings emphasize the need for continued vigilance and cooperation to prevent future exploits and protect the integrity of the crypto ecosystem.