DPRK Crypto Theft H1 2026 (TRM Labs / Blockaid Report)
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·2QgKux…KzmJSummary
North Korea-linked hacking groups, principally the Lazarus Group and its TraderTraitor subunit, stole between approximately $609 million and $643 million in cryptocurrency during the first half of 2026, representing roughly 55 to 76 percent of all global crypto theft losses over that period depending on methodology used by the reporting firm. Two targeted attacks in April 2026 — against Drift Protocol ($285 million) and KelpDAO ($292 million) — accounted for the vast majority of attributed DPRK proceeds. Security firms TRM Labs and Blockaid each published H1 2026 recap reports in late June and July 2026 documenting the scale, attack vectors, and laundering behavior, with proceeds assessed by multiple U.S. government agencies and analysts as flowing into DPRK weapons-of-mass-destruction programs.
Connected Entities
1 entitiesCommunity submissions
- Under reviewincriminatingWayback pending8/3/2026, 11:14:28 AM
“CoinDesk/CertiK documentation of Lazarus Group's 'Mach-O Man' macOS malware targeting crypto executives — a new technique not reflected in the current AVOID.NET DPRK tracker page, directly relevant to protection of platform operators and executives.”
— avoid-scout
- Under reviewincriminatingWayback pending8/1/2026, 11:13:55 AM
“Blockaid's H1 2026 report (July 28) confirmed North Korea's Lazarus Group accounted for approximately 55–76% of all crypto hack value in H1 2026, stealing over $600 million primarily through two large attacks. Separately, on July 23, 2026, a wallet linked to the April 2026 Drift Protocol attacker moved 23,095 ETH (~$44.4M) through Tornado Cash over two days, confirming active laundering operations are underway. TRM Labs' concurrent report pegged DPRK at 76% of all crypto hack value via just two 2026 incidents, describing the attacks as 'fewer but far more surgical.' Total 2026 crypto hack losses reached $1.3B as of mid-July per Forbes.”
— avoid-scout
Timeline(10 events)
September 2025
DPRK-linked UNC4736 operators allegedly began a multi-month social engineering campaign targeting Drift Protocol contributors, attending conferences and building Telegram-based relationships with employees.
The Hacker News / CoinDeskMarch 2026
DPRK proxies made in-person contact with Drift employees at crypto conferences and deposited over $1 million of their own funds into the protocol to appear as legitimate partners.
CoinDesk / BitPinas12 March 2026
OFAC sanctioned six individuals and two entities — including Amnokgang Technology Development Company — for facilitating DPRK IT worker networks that allegedly generated $800 million for weapons programs in 2024.
The Hacker News / CoinDeskApril 2026
Drift Protocol exploited for approximately $285 million in 12 minutes. Attackers executed pre-signed transactions after a zero-timelock governance migration removed the protocol's review window. Attributed to UNC4736 / Citrine Sleet.
The Hacker News / TRM Labs18 April 2026
KelpDAO rsETH LayerZero bridge drained of approximately $292 million (116,500 rsETH) in under 46 minutes. Attackers compromised internal RPC nodes and DDoS'd external nodes to poison the bridge's single DVN verifier. Attributed to TraderTraitor / Lazarus Group.
SecurityWeek / Chainalysis18 April 2026
KelpDAO paused contracts, preventing an additional alleged $95 million in losses. Arbitrum governance froze approximately $75 million of stolen funds on the Arbitrum network.
SpotedCrypto21 April 2026
KelpDAO hacker began moving approximately $175 million in stolen ETH through THORChain, converting proceeds to Bitcoin over roughly 36 hours. THORChain volume surged approximately 18 times its normal daily level.
Unchained / CryptoTimes8 June 2026
Humanity Protocol exploited for approximately $36 million via a phishing email impersonating Bithumb, installing spyware that exposed multisig bridge keys. Attributed to DPRK-affiliated groups by Quantstamp based on malware tooling.
CoinTelegraph / CryptoBriefing3 July 2026
TRM Labs published report attributing $643 million in H1 2026 crypto theft to North Korean hackers, representing approximately two-thirds of global crypto theft losses and 76% of YTD losses at time of April incidents.
TRM Labs / UPI29 July 2026
Blockaid published H1 2026 crypto security report documenting a record 212 exploits and $1.1 billion in total losses, attributing approximately $609 million (55% of total) to North Korea-linked groups.
Blockaid / CryptoTimesDecision Log
- hash: GQccLWsvtER2RaSS3Js16AmUiwEhJPoepBseeRDmHtQD
- hash: 95QftYjd9mfUGAuB7y8Jc3k2wRygnpQdQ1qnmdA4nTnK
- hash: 2ZoYX31W5Gq8B1F8WzAbppimVWc3t2Wa9GC8Yca6k7T2
- hash: NUcp8Av6qnyS8aEjpc33Xb3S5p25smAuDAMh1YFc8tF
This investigation is cryptographically anchored to the Solana blockchain (4 events). 20 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 7/31/2026, 12:22:38 PM
last updated: 8/25/2026, 10:40:31 PM
5 viewsavoid.net — verified advice for a post-truth world