TRM Labs: North Korea-linked hackers drive 76% of 2026 crypto thefts

TRM Labs says North Korea-linked hackers have stolen about $577m in 2026 so far—76% of all crypto hack losses—driven by massive hits on KelpDAO and Drift Protocol.

A new report from blockchain intelligence firm TRM Labs finds that organizations linked to North Korea were responsible for roughly 76% of all global cryptocurrency hacking losses in the first four months of 2026, stealing an estimated $577 million. The report, cited by The Block, warns that North Korean operations have become the dominant source of on-chain theft as state-aligned groups refine their tactics against exchanges, DeFi protocols, and cross-chain infrastructure.

According to the analysis, North Korea’s share of global crypto theft has climbed relentlessly over the past five years: 22% in 2022, 37% in 2023, 39% in 2024, 64% in 2025, and 76% so far in 2026, pushing cumulative illicit profits since 2017 above $6 billion. TRM Labs ties this growth to increasingly sophisticated tooling, better laundering pipelines, and a clear state incentive to bypass traditional sanctions via digital assets.

The report highlights two April incidents as the primary drivers of 2026 losses to date: a roughly $292 million exploit targeting KelpDAO and a separate $285 million theft from Drift Protocol. Together, these two attacks alone account for nearly the entire $577 million total so far this year and about 3% of all recorded hacking incidents in the same period, suggesting that a small number of high-impact exploits continue to dominate loss statistics.

For crypto markets, the concentration of large-scale thefts in DeFi and restaking protocols underscores the structural risk in smart contract and bridge design. Each $200 million–plus drain not only hits token prices for the affected projects, but also tightens liquidity across interconnected ecosystems as market makers, lenders, and LPs de-risk exposure.

This trend also feeds into regulatory and institutional responses. As more of the loss profile is attributed to a single sanctioned state, global authorities will likely intensify pressure on centralized exchanges, OTC desks, and mixers to block known laundering channels, raising compliance costs for the entire industry. For traders in Bitcoin, Ethereum, and other majors, repeated headlines of nine-figure hacks tied to North Korea translate into higher perceived tail risk, wider risk premia, and occasional systemic bouts of deleveraging when large exploits force on-chain liquidations.

Overall, TRM Labs’ findings paint a picture of a crypto market where protocol innovation and capital inflows continue, but where the “crypto war chest” of a sanctioned state is now a central macro variable, not a side story—one that will increasingly shape both policy and risk pricing across digital assets.