North Korea Dominates Crypto Heists in April 2026, Snagging 76% of Stolen Value
April 2026 marked a concerning trend in the cryptocurrency landscape, with North Korean hacking groups being responsible for a staggering 76% of all crypto hack losses reported, according to a new analysis by TRM Labs. This alarming figure wasn't the result of numerous small-scale attacks, but rather two exceptionally large incidents that collectively netted approximately $577 million.
Two Crypto Hacks, Nearly $600M Stolen
The primary events driving North Korea's outsized share were the Drift Protocol hack on April 1 and the KelpDAO bridge exploit on April 18. The Drift Protocol breach alone accounted for $285 million in stolen assets. Just over two weeks later, the KelpDAO incident added another $292 million to the total. Despite these two hacks representing only about 3% of all crypto incidents recorded during April 2026, their sheer magnitude pushed North Korea's attributed losses to an unprecedented level. This pattern—few attacks, but massive payouts—has been a consistent hallmark of North Korea's cybercriminal strategy since 2017, and it appears to be accelerating.
April Sets New Records and Reveals Advanced Tactics
The TRM Labs report delved into the operational specifics of these high-value attacks. The Drift Protocol hack, for instance, involved an extensive three-week pre-attack staging phase and months of social engineering aimed at compromising protocol signers. Once everything was in place, the actual draining of funds was executed with chilling efficiency, reportedly taking only about 12 minutes. The KelpDAO hack, conversely, exploited a technical flaw in a single-verifier design within a LayerZero bridge. Following this breach, the attackers swiftly initiated money laundering operations, routing proceeds through THORChain after over $75 million was frozen on the Arbitrum blockchain. These findings are corroborated by data from DeFiLlama, which identified April as the month with the highest number of crypto incidents in history, further underscoring the escalating threat landscape.
