Blab Crypto
North Korea-Linked Hackers Account for $643 Million in First-Half 2026 Crypto Theft, TRM Labs Report Shows
North Korean‑affiliated cybercriminals have siphoned $643 million in cryptocurrency during the first six months of 2026, a new analysis from blockchain‑analytics firm TRM Labs reveals. That figure represents 66.2 percent of the $972 million stolen worldwide in the same period.
The report documents 207 separate hacks in H1 2026—more than any other half‑year on record. Yet total losses were less than half of the $2.3 billion stolen in H1 2025, indicating that while the number of incidents has climbed, the value of each breach has declined.
Two of the largest attacks were a $285 million exploit of the Solana‑based DeFi platform Drift on April 1 and a $292 million breach of the KelpDAO protocol on April 18. Together, those incidents account for $577 million of the North‑Korea‑linked theft, leaving $66 million attributed to other, smaller attacks.
TRM Labs notes that the $643 million figure covers only hacks and exploits. The firm also points out that North Korea continues to generate revenue through other illicit channels—including phishing campaigns, social‑engineering scams, fraud, and covert IT‑worker operations—activities that are not reflected in the theft totals but likely add to the regime’s overall crypto‑related income.
The report was released shortly after the fifth Trilateral Diplomatic Working Group meeting on North Korea’s cyber threats, which convened in Washington on June 25‑26. A U.S. State Department spokesperson told Voice of America that North Korea is increasingly turning to cybercrime to evade international sanctions and to finance its weapons‑of‑mass‑destruction and ballistic‑missile programs. The spokesperson added that cryptocurrency theft and money laundering have become a significant part of that strategy.
The findings underscore the continued relevance of state‑backed cyber operations in the global crypto ecosystem. While the number of hacks has risen, the value of stolen assets has fallen, suggesting a shift toward smaller, more frequent attacks. The report also highlights the need for continued vigilance by exchanges, DeFi platforms, and regulators, particularly as North Korea’s cyber capabilities are managed by the Reconnaissance General Bureau and its Bureau 121 unit.
At present, the $643 million figure is the most comprehensive publicly available estimate of North‑Korea‑linked crypto theft for the first half of 2026. The report does not detail the subsequent movement of the stolen funds, nor does it confirm whether any of the assets have been recovered. Further investigations by law‑enforcement agencies and blockchain analytics firms are expected to clarify the full extent of the regime’s illicit crypto operations.
The report documents 207 separate hacks in H1 2026—more than any other half‑year on record. Yet total losses were less than half of the $2.3 billion stolen in H1 2025, indicating that while the number of incidents has climbed, the value of each breach has declined.
Two of the largest attacks were a $285 million exploit of the Solana‑based DeFi platform Drift on April 1 and a $292 million breach of the KelpDAO protocol on April 18. Together, those incidents account for $577 million of the North‑Korea‑linked theft, leaving $66 million attributed to other, smaller attacks.
TRM Labs notes that the $643 million figure covers only hacks and exploits. The firm also points out that North Korea continues to generate revenue through other illicit channels—including phishing campaigns, social‑engineering scams, fraud, and covert IT‑worker operations—activities that are not reflected in the theft totals but likely add to the regime’s overall crypto‑related income.
The report was released shortly after the fifth Trilateral Diplomatic Working Group meeting on North Korea’s cyber threats, which convened in Washington on June 25‑26. A U.S. State Department spokesperson told Voice of America that North Korea is increasingly turning to cybercrime to evade international sanctions and to finance its weapons‑of‑mass‑destruction and ballistic‑missile programs. The spokesperson added that cryptocurrency theft and money laundering have become a significant part of that strategy.
The findings underscore the continued relevance of state‑backed cyber operations in the global crypto ecosystem. While the number of hacks has risen, the value of stolen assets has fallen, suggesting a shift toward smaller, more frequent attacks. The report also highlights the need for continued vigilance by exchanges, DeFi platforms, and regulators, particularly as North Korea’s cyber capabilities are managed by the Reconnaissance General Bureau and its Bureau 121 unit.
At present, the $643 million figure is the most comprehensive publicly available estimate of North‑Korea‑linked crypto theft for the first half of 2026. The report does not detail the subsequent movement of the stolen funds, nor does it confirm whether any of the assets have been recovered. Further investigations by law‑enforcement agencies and blockchain analytics firms are expected to clarify the full extent of the regime’s illicit crypto operations.
