North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign

2017-01-01

DPRK-linked crypto theft operations began, per TRM Labs attribution baseline. Cumulative total will exceed $6 billion by H1 2026.

2022-03-23

Lazarus Group executes $622 million Axie Infinity/Ronin bridge hack, the largest crypto theft to that date. FBI formally attributed it to Lazarus Group in April 2022.

2022-05-06

OFAC sanctions Blender.io, the first-ever designation of a virtual currency mixer, for providing services to Lazarus Group.

2023-12-01

OFAC sanctions Sinbad.io virtual currency mixer for processing millions in Lazarus Group proceeds from the Horizon Bridge and Axie Infinity heists.

2025-02-21

Lazarus Group executes the $1.5 billion Bybit hack, at the time the single largest crypto theft on record, via compromise of a Safe{Wallet} developer's workstation and malicious JavaScript injection.

2025-12-18

Chainalysis publishes full-year 2025 report: North Korea stole $2.02 billion in 2025, a 51% year-over-year increase, pushing all-time DPRK crypto theft to approximately $6.75 billion.

2025-09-01

Alleged start of Drift Protocol social engineering campaign. DPRK operatives allegedly began cultivating relationships with Drift contributors, posing as a quantitative trading firm.

2026-03-11

On-chain staging for Drift Protocol attack begins: 10 ETH withdrawn from Tornado Cash, deployed around 09:00 Pyongyang Standard Time to fund CarbonVote Token deployment.

2026-03-12

OFAC sanctions six DPRK IT worker facilitators and two entities (including Amnokgang Technology Development Company) for schemes generating nearly $800 million in 2024.

2026-03-23

Attackers create multiple durable nonce accounts on Solana — a feature enabling pre-signed transactions to execute later without expiration — in preparation for the Drift exploit.

2026-03-27

Drift Protocol migrates its Security Council to a new 2-of-5 threshold configuration with zero timelock, eliminating the delay that would have permitted detection and intervention.

2026-04-01

Drift Protocol is drained of approximately $285 million in roughly 12 minutes. Stolen USDC is moved across 100+ transactions via Circle's CCTP over six hours. DRIFT token falls over 40%.

2026-04-18

KelpDAO's LayerZero bridge is drained of approximately $292 million in rsETH. Attackers compromise two RPC nodes and DDoS remaining nodes, forcing failover to poisoned infrastructure. Cascading effects trigger an estimated $10 billion Aave withdrawal wave.

2026-04-20

LayerZero publishes incident report attributing the KelpDAO exploit to DPRK's Lazarus Group / TraderTraitor, citing KelpDAO's single-DVN configuration as a critical enabling factor.

2026-04-21

Arbitrum Network Security Council freezes 30,766 ETH (approximately $71 million) of KelpDAO attacker funds, recovering roughly 25% of stolen assets.

2026-04-30

CoinDesk publishes TRM Labs-sourced reporting that DPRK actors account for 76% of 2026 crypto exploit losses through April, with cumulative theft since 2017 topping $6 billion.

2026-05-05

KelpDAO publicly disputes LayerZero's attribution of blame to KelpDAO's configuration, stating that LayerZero had approved the single-DVN setup.

2026-06-30

TRM Labs publishes H1 2026 crypto hacks report: 207 incidents totaling $972 million, with $643 million (66%) attributed to DPRK actors. Q2 2026 recorded 123 incidents, a record-setting quarter.