North Korea has rejected allegations of state-backed cryptocurrency theft even as new data ties it to most global hack losses in early 2026.
Summary
- TRM Labs said North Korea-linked actors stole about $577 million in crypto through April 2026, accounting for 76% of global hack losses.
- North Korea’s Foreign Ministry dismissed the allegations as politically motivated, calling them “absurd slander” in remarks carried by state media.
- The U.S. Treasury sanctioned six individuals and two entities tied to DPRK IT worker schemes that generated nearly $800 million in 2024.
According to TRM Labs, actors linked to the Democratic People’s Republic of Korea were responsible for about $577 million in stolen crypto between January and April 2026, accounting for 76% of all global hacking losses during the period. TRM Labs reported that this figure was largely driven by two April exploits, including a $292 million breach of KelpDAO and a $285 million attack on Drift Protocol.
State media outlet Korean Central News Agency reported on Sunday that a spokesperson for North Korea’s Foreign Ministry dismissed the accusations as “absurd slander” and described them as a political tool used by the United States to justify what it called a hostile policy. In the same statement, the spokesperson argued that it was unreasonable for Washington, which they described as having the world’s most advanced cyber capabilities, to present itself as the “world’s greatest victim,” and said the country would take “all necessary measures” to defend its interests.
Hack concentration rises as attribution strengthens
Data compiled by TRM Labs shows a steady increase in North Korea’s share of global crypto theft over recent years, rising from below 10% in 2020 and 2021 to 64% in 2025, before reaching 76% in the first four months of 2026. TRM Labs said cumulative crypto theft attributed to the country has now exceeded $6 billion since 2017.
In its attribution analysis, TRM Labs linked the KelpDAO exploit to TraderTraitor, an operation associated with the Lazarus Group, while noting that the Drift Protocol attack involved a separate subgroup that remains under investigation. The firm added that the two incidents together accounted for only about 3% of total hacking cases by count through April, indicating that a small number of large breaches continue to dominate total losses.
Earlier reporting by TRM Labs, cited by The Block, noted that North Korean operations have become more effective due to improved tooling and laundering methods, alongside a state incentive to bypass sanctions through digital assets. The same analysis connected these developments to repeated targeting of exchanges, DeFi protocols, and cross-chain systems.
A recent report by the United Nations said stolen digital assets linked to North Korean actors serve as a key funding source for the country’s nuclear and ballistic missile programs, reinforcing long-standing concerns among international authorities.
On March 13, the U.S. Department of the Treasury, through its Office of Foreign Assets Control, sanctioned six individuals and two entities tied to North Korean IT worker schemes that generated nearly $800 million in 2024, including networks that facilitated cryptocurrency transactions and converted funds into digital assets.
