A new report from blockchain intelligence firm TRM Labs reveals that North Korean hacking groups have stolen 76% of all cryptocurrency lost to hacks so far in 2026. The staggering figure comes from just two incidents.
The first attack occurred on April 1, targeting the Drift Protocol for $285 million. The second hit on April 18 exploited the KelpDAO bridge, netting $292 million. Combined, these two breaches account for only 3% of all crypto incidents this year, yet represent the vast majority of stolen value.
This pattern is accelerating. North Korea's share of crypto hack losses has grown from under 10% in 2020 to 22% in 2022, 37% in 2023, 39% in 2024, and 64% in 2025. The 76% figure through April 2026 is the highest on record.
The Drift Protocol hack involved three weeks of careful staging and months of social engineering. Once ready, the entire drain took just 12 minutes. The KelpDAO exploit used a flaw in a single-verifier design in a LayerZero bridge. Attackers quickly laundered funds through THORChain after over $75 million was frozen on the Arbitrum blockchain.
DeFiLlama tracks April as the most-hacked month in crypto history by number of incidents.
