North Korean groups accounted for 76% of crypto hack losses through April 2026, concentrated in two incidents totaling ~$577M: Drift Protocol (Apr 1, $285M) and KelpDAO LayerZero bridge exploit (Apr 18, $292M). - Historical trend shows accelerating share of stolen value: <10% (2020–21) → 22% (2022) → 37% (2023) → 39% (2024) → 64% (2025) → 76% (2026 YTD), signaling large, targeted attacks that heighten DeFi and protocol risk. - Attack vectors and aftermath: Drift involved months of social engineering and ~3 weeks staging before a ~12‑minute drain; KelpDAO exploited a single‑verifier bridge flaw; attackers laundered via THORChain after >$75M was frozen on Arbitrum — issues for bridge security, laundering risk, and crypto asset protection.

Bearish

Predictions Markets

See what traders are focused on

View analytics →

A new crypto crime report by TRM Labs paints a stark picture of how North Korean hacking groups have been operating in 2026 so far. Through April, they were responsible for 76% of all losses tied to crypto hacks, but the report emphasizes that this outcome wasn’t driven by a steady stream of attacks.

Instead, the massive share of stolen value comes down to just two incidents whose combined haul—about $577 million—far outweighed everything else that year.

Two Crypto Hacks, Nearly $600M Stolen

The first breach highlighted by TRM Labs took place on April 1: the Drift Protocol hack. The report puts the value stolen at $285 million. The second incident followed on April 18, when the KelpDAO bridge exploit reportedly resulted in $292 million in losses.

What’s striking is that these two events account for only about 3% of the total number of crypto incidents in 2026 during that period.

Yet together, they represent 76% of the stolen value, underlining a pattern the report says has defined North Korea’s approach across most years since 2017—relatively few attacks, but extremely outsized payouts.

The report also charts how North Korea’s share of crypto hack losses has grown over time. It notes that the figure was under 10% in 2020 and 2021, then rose to 22% in 2022, 37% in 2023, 39% in 2024, and 64% in 2025.

The 76% figure through April 2026 is described as the highest sustained share on record, suggesting that the pattern seen in recent years is not just continuing, but accelerating.

April Sets New Record Of Incidents

TRM Labs details how the Drift Protocol hack was carried out, focusing on the time and preparation that preceded the actual drain. The crypto hack involved about three weeks of pre-attack staging.

It also included months of social engineering intended to compromise protocol signers. Once the attackers were in position, the full drain reportedly took place in roughly 12 minutes, showing how planning can turn into rapid theft at the moment of execution.

The KelpDAO hack, dated April 18, followed a very different technical path. According to TRM Labs’ crypto crime report, the exploit centered on a flaw in a single-verifier design used in a LayerZero bridge.

After the breach, the attackers moved quickly into laundering: they routed proceeds through THORChain after more than $75 million was frozen on the Arbitrum blockchain (ARB).

The findings align with another data point from the broader crypto ecosystem. DeFiLlama, which tracks activity and incidents in decentralized finance (DeFi), flagged April as the most-hacked month in crypto history by number of incidents.