The Democratic People’s Republic of Korea has formally pushed back against fresh accusations that its state-sponsored hackers are behind the majority of cryptocurrency thefts in 2026. A spokesperson for the country’s Foreign Ministry, speaking through the Korean Central News Agency, labeled the claims as baseless and politically driven, insisting that the United States is using such allegations to further its hostile stance toward Pyongyang.
Blockchain analytics firm TRM Labs had earlier reported that North Korean-linked groups were responsible for approximately $577 million in stolen digital assets between January and April 2026. This figure represents a staggering 76% of all crypto hack losses globally during that period. The report highlighted two major April incidents: a $292 million breach of KelpDAO and a $285 million attack on Drift Protocol, both attributed to North Korean actors.
In its rebuttal, the North Korean government argued that it is unreasonable for Washington—a nation with the most advanced cyber capabilities—to portray itself as the primary victim of cybercrime. The spokesperson vowed that Pyongyang would take all necessary steps to safeguard its national interests against what it perceives as unwarranted smears.
TRM Labs data indicates that North Korea’s share of global crypto theft has grown sharply over the years. It stood below 10% in 2020 and 2021, climbed to 64% in 2025, and reached 76% in the first four months of 2026. Cumulative losses tied to the country have now surpassed $6 billion since 2017. The firm attributed the KelpDAO exploit to the TraderTraitor subgroup of the Lazarus Group, while the Drift Protocol attack is linked to a separate faction still under investigation.
These two large heists, despite accounting for only about 3% of total hacking incidents by count, drove the majority of losses, illustrating how a few high-value breaches dominate the landscape. TRM Labs previously noted that North Korean operations have become more effective through improved tools, sophisticated laundering techniques, and a state-driven incentive to bypass international sanctions. The United Nations has also weighed in, stating in a recent report that cryptocurrency stolen by North Korean actors directly funds the country’s nuclear and ballistic missile programs.
Meanwhile, the U.S. Department of the Treasury sanctioned six individuals and two entities in March 2026 for their involvement in North Korean IT worker schemes. These operations generated nearly $800 million in 2024 alone, using networks to facilitate crypto transactions and convert funds into digital assets.