DPRK Crypto Theft H1 2026 (TRM Labs / Blockaid Report)
Summary
North Korea-linked hacking groups, principally the Lazarus Group and its TraderTraitor subunit, stole between approximately $609 million and $643 million in cryptocurrency during the first half of 2026, representing roughly 55 to 76 percent of all global crypto theft losses over that period depending on methodology used by the reporting firm. Two targeted attacks in April 2026 — against Drift Protocol ($285 million) and KelpDAO ($292 million) — accounted for the vast majority of attributed DPRK proceeds. Security firms TRM Labs and Blockaid each published H1 2026 recap reports in late June and July 2026 documenting the scale, attack vectors, and laundering behavior, with proceeds assessed by multiple U.S. government agencies and analysts as flowing into DPRK weapons-of-mass-destruction programs.
Connected Entities
1 entities · 10 linked investigationsTimeline(10 events)
2025-09-01
DPRK-linked UNC4736 operators allegedly began a multi-month social engineering campaign targeting Drift Protocol contributors, attending conferences and building Telegram-based relationships with employees.
The Hacker News / CoinDesk2026-03-01
DPRK proxies made in-person contact with Drift employees at crypto conferences and deposited over $1 million of their own funds into the protocol to appear as legitimate partners.
CoinDesk / BitPinas2026-03-12
OFAC sanctioned six individuals and two entities — including Amnokgang Technology Development Company — for facilitating DPRK IT worker networks that allegedly generated $800 million for weapons programs in 2024.
The Hacker News / CoinDesk2026-04-01
Drift Protocol exploited for approximately $285 million in 12 minutes. Attackers executed pre-signed transactions after a zero-timelock governance migration removed the protocol's review window. Attributed to UNC4736 / Citrine Sleet.
The Hacker News / TRM Labs2026-04-18
KelpDAO rsETH LayerZero bridge drained of approximately $292 million (116,500 rsETH) in under 46 minutes. Attackers compromised internal RPC nodes and DDoS'd external nodes to poison the bridge's single DVN verifier. Attributed to TraderTraitor / Lazarus Group.
SecurityWeek / Chainalysis2026-04-18
KelpDAO paused contracts, preventing an additional alleged $95 million in losses. Arbitrum governance froze approximately $75 million of stolen funds on the Arbitrum network.
SpotedCrypto2026-04-21
KelpDAO hacker began moving approximately $175 million in stolen ETH through THORChain, converting proceeds to Bitcoin over roughly 36 hours. THORChain volume surged approximately 18 times its normal daily level.
Unchained / CryptoTimes2026-06-08
Humanity Protocol exploited for approximately $36 million via a phishing email impersonating Bithumb, installing spyware that exposed multisig bridge keys. Attributed to DPRK-affiliated groups by Quantstamp based on malware tooling.
CoinTelegraph / CryptoBriefing2026-07-03
TRM Labs published report attributing $643 million in H1 2026 crypto theft to North Korean hackers, representing approximately two-thirds of global crypto theft losses and 76% of YTD losses at time of April incidents.
TRM Labs / UPI2026-07-29
Blockaid published H1 2026 crypto security report documenting a record 212 exploits and $1.1 billion in total losses, attributing approximately $609 million (55% of total) to North Korea-linked groups.
Blockaid / CryptoTimesDecision Log
- #1publish⛓ pending7/31/2026, 12:22:48 PMhash: NUcp8Av6qnyS8aEjpc33Xb3S5p25smAuDAMh1YFc8tF
20 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 7/31/2026, 12:22:38 PM
last updated: 7/31/2026, 7:05:11 PM
avoid.net — verified advice for a post-truth world