North Korea denies involvement in $577M crypto thefts

Traders Union
All News
Crypto
North Korea denies involvement

Victims of hacker attacks

In the first four months of 2026, groups linked to North Korea stole about $577 million, according to TRM Labs. This accounted for 76% of all global losses from cryptocurrency hacks during that period.

Most of that amount came from two attacks in April: the $292 million KelpDAO exploit and the $285 million attack on Drift Protocol. At the same time, these two incidents accounted for only about 3% of all recorded cryptocurrency attacks by number of cases since the start of the year.

TRM Labs linked the KelpDAO hack to TraderTraitor, an operation affiliated with Lazarus. The company attributed the Drift Protocol attack to another subgroup, although final attribution is still under review. Since 2017, the total amount of cryptocurrency stolen by entities linked to North Korea has exceeded $6 billion.

U.S. and international authorities have repeatedly stated that such funds are used to finance North Korea’s military infrastructure. A recent UN report noted that stolen digital assets are an important source of revenue for Pyongyang’s nuclear and missile programs.

The United States also continues to impose sanctions on individuals and companies linked to such schemes. On March 13, the U.S. Treasury’s Office of Foreign Assets Control imposed restrictions on six individuals and two entities connected to North Korean IT schemes. According to the agency, in 2024 they helped generate nearly $800 million, including through cryptocurrency transactions and the conversion of funds into digital assets.

Why North Korea has so many hackers

One reason for this activity is North Korea’s international isolation. The country has been under strict sanctions for decades, has limited access to the global financial system, and cannot freely attract foreign currency through regular trade or investment. Against this backdrop, cyberattacks have become a way for the regime to obtain money while bypassing banks, payment systems, and international oversight.

Cryptocurrencies are especially convenient for such schemes: they can be quickly transferred across borders, split across many wallets, mixed through services that obscure traces, and converted into other assets. That is why hacker groups linked to North Korea are viewed not simply as cybercriminals, but as part of a state-backed revenue system. According to analysts and international authorities, stolen digital assets may be used to finance military programs, including missile and nuclear development.

As a reminder, in 2025 North Korean hackers stole more than $2 billion in cryptocurrency.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.