Adversary Intelligence — 2026-05-03

North Korea Rejects Cyber Theft Allegations as U.S. Links Lazarus Group to 76% of 2026 Crypto Losses

North Korea's Foreign Ministry, in a KCNA statement on Sunday, rejected U.S. accusations of state-sponsored hacking and cryptocurrency theft as "absurd slander" and warned it would take "all necessary measures" to defend its interests in cyberspace. The Korea Herald reported that foreign media attributed a $290 million theft from Kelp DAO on April 20 to TraderTraitor, a Lazarus Group subgroup, and linked a separate $289.7 million theft from Drift Protocol earlier in April to North Korea. The U.S. Justice Department in April sentenced two Americans for embedding North Korean IT workers in more than 100 U.S. companies, including Fortune 500 firms and a defense contractor, per AFP. Reuters reported the U.S. Treasury sanctioned six individuals and two entities tied to North Korean IT worker networks in March.

Analysis
Pyongyang's denial, framing U.S. attribution as "absurd slander" per a KCNA statement, follows a standing response pattern and signals no change in operational posture. The concurrent IT worker infiltration of Fortune 500 firms and a defense contractor, alongside two attributed April thefts totaling roughly $580 million, indicates simultaneous revenue extraction and access acquisition rather than sequential objectives. NK-linked actors will likely conduct at least one additional cryptocurrency theft or DeFi exploit exceeding $50 million before September 2026, grounded in operational tempo and capability against both centralized and decentralized protocols established across the April operations. The 76 percent attribution figure may reflect methodology disproportionately assigning unsolved DeFi exploits to NK actors rather than genuine operational dominance.

3 sources

North Korea rejects cybercrime allegations, accuses US of smear campaign - Korea Herald
North Korea calls US cyber crime accusations absurd slander - Free Malaysia Today
North Korea calls US cyber threat claims a fabrication, warns of countermeasures - MarketScreener