North Korea Accounted for 76% of 2026 Crypto Hack Losses in First Four Months, $577M Stolen: TRM Labs

According to TRM Labs, North Korean actors extracted approximately $577 million through the first four months of 2026, representing 76% of all global cryptocurrency hack losses during the period. The losses stem from two April incidents: the $292 million KelpDAO exploit and the $285 million Drift Protocol attack. TRM attributed the Drift attack to a North Korean subgroup separate from TraderTraitor, a well-documented Lazarus-affiliated operation, while the KelpDAO breach was carried out by TraderTraitor. The Drift hack involved months of in-person coordination and culminated in a 12-minute execution on April 1 after attackers pre-authorized transactions through Drift’s Security Council. The KelpDAO attack exploited LayerZero bridge infrastructure by compromising RPC nodes and manipulating cross-chain validation logic, draining approximately 116,500 rsETH.