North Korea Stole 76% of All Crypto Taken in 2026

TRM Labs estimates the group has stolen more than $6 billion from crypto protocols since 2017.

Crypto News

North Korea-linked hackers have captured 76% of all cryptocurrency stolen by cybercriminals so far in 2026,

to blockchain intelligence firm TRM Labs. They achieved that share through just two attacks in April, which together drained $577 million from decentralized finance (DeFi) platforms while accounting for only 3% of total incidents recorded. TRM Labs estimates the group has stolen more than $6 billion from crypto protocols since 2017.

North Korea's share of total crypto theft has grown each year. It stood at under 10% in 2020 and 2021, then rose to 22% in 2022, 37% in 2023, 39% in 2024, and 64% in 2025. The 76% figure recorded through April 2026 is the highest share on record.

2 Attacks, $577M Drained

The first attack struck Drift Protocol on April 1, draining $285 million from the Solana-based perpetuals exchange. On-chain preparation reportedly began March 11, and North Korean proxies held in-person meetings with Drift employees over the preceding months. TRM Labs analysts described that social engineering approach as potentially unprecedented for the group. On the day of the attack, the hackers exploited a Solana (