Blockchain analytics firm TRM Labs has revealed that hackers linked to North Korea are responsible for approximately 76% of all cryptocurrency thefts in 2026, amounting to nearly $577 million in stolen assets during the first four months of the year. This finding underscores the growing dominance of state-backed cybercriminal groups in the crypto ecosystem.
According to the report, North Korea’s share of global crypto hacking losses has skyrocketed from just 22% in 2022 to 76% in 2026. The total illicit funds accumulated by these groups since 2017 now exceeds $6 billion. TRM Labs attributes this surge to advanced hacking techniques, sophisticated money laundering networks, and a state-level motivation to bypass international sanctions through digital currencies.
The majority of 2026 losses stem from two major exploits in April: a $292 million attack on KelpDAO and a $285 million breach of Drift Protocol. Together, these incidents account for virtually all of the year’s thefts to date, highlighting how a handful of high-value targets can drive overall loss statistics.
This concentration of thefts in decentralized finance and restaking protocols exposes systemic vulnerabilities in smart contracts and cross-chain bridges. Each large-scale exploit not only depresses token prices for affected projects but also tightens liquidity across interconnected markets as participants reduce risk exposure.
The trend is likely to intensify regulatory scrutiny and institutional risk management. As a significant portion of crypto theft is linked to a sanctioned nation, global authorities may increase pressure on exchanges, over-the-counter desks, and mixing services to shut down known laundering pathways, raising compliance costs industry-wide. For traders of major cryptocurrencies, repeated headlines about nine-figure hacks tied to North Korea contribute to higher perceived tail risk, wider risk premiums, and occasional market deleveraging when exploits trigger on-chain liquidations.
Ultimately, TRM Labs’ analysis illustrates a landscape where while protocol innovation and capital inflows persist, the so-called crypto war chest of a sanctioned state has become a central macroeconomic factor—one that will increasingly influence both policy decisions and risk assessment across digital assets.