Two Strikes, Half a Billion: How North Korean Hackers Seized 76% of All Stolen Crypto in Just 120 Days

North Korean cyber-operatives have once again demonstrated how a handful of precision strikes can fundamentally reshape annual cryptocurrency crime statistics. According to data from TRM Labs, between January and April 2026, groups affiliated with the Democratic People’s Republic of Korea (DPRK) accounted for 76% of all losses sustained via crypto-industry breaches, despite these losses originating from only two primary incidents.

Analysts estimate the aggregate damages from the assaults on Drift Protocol and KelpDAO at approximately $577 million. The exploitation of Drift Protocol on April 1 yielded $285 million for the aggressors, while the breach of the KelpDAO bridge on April 18 accounted for an additional $292 million. Collectively, these two incidents represented only a fraction of the total number of attacks in 2026, yet they secured for North Korea the lion’s share of all purloined capital.

TRM Labs notes that the DPRK’s proportional involvement in cryptocurrency theft has ascended consistently for several years. In 2020 and 2021, the figure remained below 10%, rising to 22% in 2022, 37% in 2023, 39% in 2024, and reaching 64% in 2025. This surge was further exacerbated by the February 2025 breach of Bybit, where $1.46 billion was exfiltrated from a cold wallet—an event TRM Labs characterizes as the most significant cryptocurrency theft in history.

The offensive against Drift Protocol was distinguished by its protracted preparation. TRM Labs posits that the adversaries initiated on-chain maneuvers as early as March 11, following several months of social engineering targeting project personnel. The report further indicates that North Korean intermediaries went so far as to engage in face-to-face meetings with Drift representatives.

Subsequently, the attackers leveraged the Solana durable nonce mechanism, which facilitates the preemptive signing of transactions for later broadcast. On April 1, these pre-staged operations enabled the exfiltration of funds within a mere twelve-minute window. Following an expeditious exchange and bridging of assets to Ethereum, the stolen cryptocurrency has, thus far, remained dormant.

In the instance of KelpDAO, the assailants targeted the rsETH LayerZero bridge. They compromised two internal RPC nodes and induced malfunctions in external nodes via a distributed denial-of-service (DDoS) attack, thereby precipitating the false validation of a cross-chain message.

TRM Labs identifies the critical vulnerability as a single-verifier architecture that lacked independent confirmation requirements. Following the incursion, the Arbitrum Security Council froze approximately $75 million; however, the perpetrators successfully converted roughly $175 million in ETH into Bitcoin, primarily utilizing THORChain.

TRM Labs attributes the KelpDAO breach to the TraderTraitor collective, noting that a portion of the funds utilized to orchestrate the attack is traceable to a Bitcoin wallet belonging to Wu Huihui, a Chinese cryptocurrency broker indicted in 2023 for laundering assets on behalf of Lazarus. The firm estimates that the cumulative volume of cryptocurrency stolen by North Korean entities since 2017 has now surpassed $6 billion.

TRM Labs issues a stern warning to exchanges and DeFi projects regarding the inherent risks associated with THORChain, cross-chain bridges, and Solana multi-signature wallets. The company advises a rigorous audit of all April inflows, with particular scrutiny directed toward Bitcoin originating from THORChain swaps and any assets linked to the addresses involved in the Drift and KelpDAO thefts.