North Korean Hackers Cause 76% of Early 2026 Crypto Losses

Blockchain intelligence firm TRM Labs reported that hackers linked to North Korea accounted for 76 percent of global cryptocurrency hack losses in the first four months of 2026, stealing approximately 577 million. The figure stems primarily from two major exploits in April: a 285 million breach of Drift Protocol on April 1 and a 292 million attack on KelpDAO on April 18.

In the Drift Protocol incident, attackers employed sophisticated social engineering, including months of in-person meetings between North Korean proxies and Drift employees. TRM Labs analysts detailed how hackers exploited Solana's durable nonce feature between March 23 and 30, tricking two of five Security Council signers into preapproving 31 withdrawals. Drift had recently shifted to a zero-timelock configuration, enabling the hackers to execute the drain in just 12 minutes. The stolen funds, converted to USDC and bridged to Ethereum, have remained largely dormant since.

The KelpDAO exploit, attributed to the Lazarus Group's TraderTraitor unit, involved compromising internal RPC nodes and launching a DDoS attack to manipulate a single-verifier bridge. Attackers drained about 116,500 rsETH, routing proceeds...