North Korea-linked hackers have stolen a cumulative $6.75 billion in cryptocurrency since 2017, according to TRM Labs data through mid-2026. The DPRK accounted for 76% of all crypto hack value in 2026 through April — the highest sustained share on record — driven by two April incidents that toget...
"The biggest H1 2026 crypto hacks weren't code bugs. $1.3 billion stolen, and the weakest link has moved from code to keys and people." — Ronghui Gu, CEO, CertiK
North Korea-linked hackers have stolen a cumulative $6.75 billion in cryptocurrency since 2017, according to TRM Labs data through mid-2026. The DPRK accounted for 76% of all crypto hack value in 2026 through April — the highest sustained share on record — driven by two April incidents that together yielded $577 million.
The composition of attack vectors has shifted materially. In H1 2026, smart contract exploits accounted for 60% of incidents by count but only 24% of dollar losses, according to CertiK's Hack3D report. Infrastructure and operational compromises — private key theft, social engineering, firmware vulnerabilities — represented roughly 15% of incidents but 76% of total losses. The implication: the attack surface has migrated from on-chain code to off-chain humans and hardware.
This report examines three cases that define the current threat landscape: the Drift Protocol social engineering operation ($285 million), the Coldcard hardware wallet firmware exploit ($116 million), and the legal response through Bybit's RICO lawsuit against the DPRK. Together, they illustrate an adversary that has industrialized its theft operations across every layer of the crypto stack.
CertiK's Hack3D H1 2026 report recorded 344 security incidents producing $1.31 billion in gross losses. After frozen and recovered funds, adjusted net losses were approximately $1.2 billion. On a year-over-year basis, gross losses fell 46.8% from H1 2025 — but that comparison is distorted by the $1.4 billion Bybit hack in February 2025. Excluding that outlier, H1 2026 losses were approximately 28% higher on a comparable basis.
Top five incidents by loss size, H1 2026:
| Rank | Protocol | Date | Loss ($M) | Vector | |------|----------|------|-----------|--------| | 1 | Kelp DAO | April 18 | $291.3 | RPC/DVN compromise | | 2 | Drift Protocol | April 1 | $285.0 | Social engineering / wallet compromise | | 3 | Coldcard | July 30 | $116.0 | Firmware vulnerability | | 4 | Tectonic (Cronos) | August | $74.0 | Lending protocol exploit | | 5 | Arbitrum incident | H1 | $71.0 | Smart contract exploit |
April was the worst month in four years. CertiK CEO Ronghui Gu noted there were only three days in April without a recorded hack. The Kelp DAO and Drift Protocol breaches alone accounted for 44% of all H1 losses.
TRM Labs attributed approximately $643 million — roughly two-thirds of all H1 2026 theft — to DPRK-linked groups. Nearly 90% of North Korea's stolen proceeds, approximately $577 million, came from just two April attacks on DeFi platforms.
Attack vector distribution, H1 2026 (CertiK):
| Vector Type | % of Incidents | % of Dollar Losses | |-------------|----------------|-------------------| | Smart contract exploits | ~60% | ~24% | | Infrastructure/operational compromise | ~15% | ~76% | | Other (phishing, rug pulls, etc.) | ~25% | — |
The data shows a structural divergence: the most common attack type produces the least damage per incident, while the rarer infrastructure compromises account for the vast majority of dollar losses.
On April 1, 2026, attackers drained $285 million from Drift Protocol, a Solana-based decentralized futures exchange, in 12 minutes. The attack itself was fast. The preparation took six months.
According to Drift's post-incident disclosure and TRM Labs' analysis, the operation began in the fall of 2025. Threat actors posed as representatives of a quantitative trading firm and made initial contact with Drift personnel at a conference. Face-to-face meetings followed at multiple industry events over the subsequent months.
"The individuals who appeared in person were not North Korean nationals," Drift stated. "DPRK threat actors operating at this level are known to deploy third-party intermediaries to conduct face-to-face relationship-building."
A Telegram group was established. Over months, the actors engaged in substantive conversations about trading strategies and vault integrations — interactions Drift described as "typical of how trading firms interact and onboard." The threat actors deposited $1 million of their own capital to open a vault, establishing operational credibility.
On the day of the attack, the compromised access was leveraged to drain $285 million in user assets. Drift attributed the attack with medium confidence to UNC4736, a North Korean state-sponsored group also tracked as AppleJeus, Citrine Sleet, Golden Chollima, and Gleaming Pisces.
The Drift case represents a qualitative escalation. Previous DPRK operations relied on phishing emails, compromised npm packages, and remote social engineering. The Drift attack deployed in-person intermediaries over a multi-month timeline, targeting the trust relationships that protocols rely on for business development. Crowell & Moring, in a legal analysis, identified "social trust" as the emerging cybersecurity gap — a vector that falls outside the scope of smart contract audits, formal verification, and conventional penetration testing.
Between July 30 and August 3, 2026, approximately 1,816 BTC ($114–116 million) were stolen from Coldcard hardware wallets in four waves. The first wave on July 30 drained 1,083 BTC — approximately $70.2 million — from 1,196 addresses in 41 minutes.
The vulnerability originated in firmware version 4.0.1, released in March 2021. A bug caused certain devices to bypass the dedicated hardware random-number generator during seed generation, substituting a predictable software-based alternative. The result: wallets created on affected firmware had significantly weaker entropy than users were told.
Attackers who discovered this flaw could replicate the weakened seed-generation process on standard hardware, enumerate possible recovery phrases, and check which corresponded to funded wallets — all without physical access to any device.
The exploit affected over 5,200 individual addresses. Coinkite, the manufacturer, halted shipments, destroyed affected inventory, and published a migration guide. TRM Labs characterized it as the largest hardware wallet exploit of 2026.
The incident challenges a core premise of self-custody security: that air-gapped hardware wallets represent the highest tier of protection. The vulnerability persisted for five years before exploitation, illustrating the time lag between firmware deployment and adversarial discovery. No audit had flagged the entropy flaw.
Stolen funds do not remain static. DPRK-linked groups have built a multi-stage laundering pipeline that has adapted to successive enforcement actions.
According to TRM Labs and Chainalysis research, the current workflow follows a consistent pattern:
Stage 1 — Cross-chain movement. Within hours of a theft, funds are bridged from the origin chain to Ethereum, where deeper liquidity supports larger mixing volumes.
Stage 2 — Chain-hopping. Funds cycle through multiple networks — Ethereum to Avalanche to BNB Chain to Bitcoin — using non-KYC bridges and DEXes to fragment the on-chain trail.
Stage 3 — Mixing. After the U.S. sanctioned Tornado Cash and Sinbad.io, DPRK operators shifted flows to cross-chain bridges — primarily THORChain — and exchange-adjacent services such as eXch.
Stage 4 — OTC conversion. Funds are converted to fiat through over-the-counter desks concentrated in Southeast Asia and the Middle East, where regulatory coverage of crypto-to-fiat conversion remains thinner.
The adaptability of this pipeline is notable. Each time a laundering node is sanctioned or shut down, operations shift to alternatives within weeks. The March 2025 U.S. delisting of Tornado Cash sanctions, following a legal challenge, introduced additional complexity — the primary tool used for earlier DPRK laundering is now legally accessible again.
DPRK cumulative theft since 2017 reached $6.75 billion as of mid-2026, per TRM Labs. The 2025 total was $2.02 billion (a 51% YoY increase), including the $1.5 billion Bybit hack. The 2026 pace, through April, showed DPRK accounting for 76% of all crypto theft value.
On August 7, 2026, Bybit filed a civil lawsuit in the U.S. District Court for the District of Columbia against the DPRK, its Reconnaissance General Bureau (RGB), and the Lazarus Group. The suit invokes the Racketeer Influenced and Corrupt Organizations Act (RICO) — a legal framework originally designed for organized crime prosecution.
The court granted a preliminary injunction freezing identified stolen digital assets held by John Doe defendants. The order stated that "Bybit has demonstrated a likelihood of success on the merits."
Bybit reported recovering $48.4 million of the $1.5 billion stolen in the February 2025 hack. Over 90% of funds remain untraceable. The exchange continues to cooperate with the FBI and blockchain analytics firms.
The RICO approach is without precedent in crypto asset recovery. By naming a sovereign state and its intelligence apparatus as defendants, Bybit has created a test case for whether civil litigation can serve as an effective tool against state-sponsored cybercrime. The preliminary injunction is a procedural step — actual asset recovery remains uncertain, as the bulk of stolen funds have already passed through laundering networks.
Recovery data across H1 2026 reveals the scale of the challenge. According to GlobalLedger's analysis:
Recovery outcomes vary by incident size. Small wallet compromises see 60–80% recovery rates, while large exchange and protocol hacks typically recover less than 1% of stolen funds.
The mechanisms that did work in H1 2026 included stablecoin issuer freezes (Tether and Circle freezing addresses), protocol governance interventions (Arbitrum's Security Council used a temporary contract upgrade to redirect $71 million), and direct negotiations with attackers in a limited number of cases.
The insurance gap compounds the problem. As covered in separate analysis, confirmed crypto insurance coverage stands at approximately $130 million against billions in annual losses — covering less than 1% of realized theft.
PeckShield recorded 50 major crypto hacks in August 2026 — the highest monthly count of the year and a 67% increase from July's 30 incidents. Total losses, however, fell 49.5% month-over-month to approximately $136.3 million.
CertiK's August figure was higher at approximately $215 million, reflecting methodological differences in incident tracking. The divergence in reported figures between security firms is itself a data-quality issue for the industry.
The average loss per hack fell to approximately $2.7 million in August, down from roughly $9 million in July. The top 10 incidents accounted for $123.34 million of PeckShield's $136.3 million total, leaving approximately $12.9 million spread across 40 smaller hacks.
The Tectonic Protocol exploit ($74 million) on Cronos accounted for more than half of August losses. The remaining incidents were distributed across lending platforms, wallets, and infrastructure services.
The pattern suggests a widening of the attacker population: more actors executing smaller-scale attacks, while state-sponsored groups continue to pursue high-value targets selectively.
The data through August 2026 describes a threat landscape that has matured along two axes. First, state-sponsored actors — primarily DPRK-linked groups — have industrialized their operations, deploying multi-month in-person social engineering campaigns, exploiting supply-chain firmware flaws, and operating adaptive laundering networks that cycle through jurisdictions faster than enforcement can respond. Second, the number of smaller-scale attacks is increasing, with August's 50-incident count setting a 2026 record even as average loss sizes decline.
The economic value implications are direct. Every dollar stolen represents a transfer from protocol users and liquidity providers to adversaries — a deadweight loss to the ecosystem that no amount of token issuance can offset. For institutional participants evaluating blockchain infrastructure, the security track record is not abstract risk analysis; it is a line item. CertiK CEO Ronghui Gu has stated that near-daily hacks are a major barrier to large-scale institutional adoption.
The industry's defenses have improved in narrow areas: smart contract auditing has reduced code-level exploit frequency, stablecoin issuers can freeze flagged addresses, and on-chain tracing has made laundering more difficult. But the attacker response has been to shift to vectors that these tools do not cover — human trust, hardware supply chains, and off-chain infrastructure. Until the security model expands to match the threat model, the gap between capital at risk and capital protected will continue to widen.