Adversary Intelligence — 2026-05-02

North Korea RGB-Linked Hackers Account for 76% of 2026 Crypto Theft With Two Targeted Operations

TRM Labs attributed two cryptocurrency exploits totaling approximately $577 million to North Korean state-backed actors, accounting for roughly 76 percent of all recorded crypto theft value through April 2026. The Drift Protocol breach drained approximately $285 million in minutes after a multi-month campaign involving direct personnel engagement and manipulation of transaction authorization mechanisms; proceeds were converted and redistributed but have since remained inactive. The KelpDAO exploit extracted approximately $292 million through compromised internal infrastructure and manipulated cross-chain verification inputs, with remaining funds moved across chains into Bitcoin primarily through decentralized liquidity protocols after an initial partial freeze.

Analysis
North Korean state-backed actors have almost certainly stolen more than $500 million in cryptocurrency through April 2026, per TRM Labs attribution corroborated by three secondary outlets. Both operations turned on insider access: Drift Protocol yielded $285 million after months of personnel manipulation and falsified transaction authorization; KelpDAO yielded $292 million through compromised infrastructure and manipulated cross-chain verification inputs. Drift proceeds remain inactive, consistent with deliberate operational timing. KelpDAO funds moved into Bitcoin through decentralized liquidity protocols after a partial freeze. Against a cumulative $6 billion since 2017, the program has demonstrated capacity to breach previously hardened institutional defenses, a pattern also consistent with state-adjacent criminal actors monetizing DPRK tradecraft rather than operating under direct RGB command.

4 sources

North Korea Enormous Crypto Hacks Redefine Scale and Strategy - Security Boulevard
North Korea Stole 76% of All Crypto Hack Value in 2026 — With Just Two Attacks - TRM Labs
North Korea accounts for 76% of 2026 crypto hack losses, with theft since 2017 topping $6 billion: TRM Labs - The Block
76% of All Crypto Stolen in 2026 Is Now in North Korea - Dark Reading