DPRK Crypto Theft H1 2026 (TRM Labs / Blockaid Report)
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·2QgKux…KzmJSummary
North Korea-linked hacking groups, principally the Lazarus Group and its TraderTraitor subunit, stole between approximately $609 million and $643 million in cryptocurrency during the first half of 2026, representing roughly 55 to 76 percent of all global crypto theft losses over that period depending on methodology used by the reporting firm. Two targeted attacks in April 2026 — against Drift Protocol ($285 million) and KelpDAO ($292 million) — accounted for the vast majority of attributed DPRK proceeds. Security firms TRM Labs and Blockaid each published H1 2026 recap reports in late June and July 2026 documenting the scale, attack vectors, and laundering behavior, with proceeds assessed by multiple U.S. government agencies and analysts as flowing into DPRK weapons-of-mass-destruction programs.
Connected Entities
17 entities · 59 linked investigations- Ethereum→mentioned with→Bitcoin(60%)
- DPRK Crypto Theft H1 2026 (TRM Labs / Blockaid Report)→mentioned with→Solana(80%)
- DPRK Crypto Theft H1 2026 (TRM Labs / Blockaid Report)→mentioned with→Resolv(60%)
- DPRK Crypto Theft H1 2026 (TRM Labs / Blockaid Report)→mentioned with→THORChain(70%)
- DPRK Crypto Theft H1 2026 (TRM Labs / Blockaid Report)→mentioned with→Arbitrum(80%)
- DPRK Crypto Theft H1 2026 (TRM Labs / Blockaid Report)→mentioned with→Jupiter Exchange(65%)
- DPRK Crypto Theft H1 2026 (TRM Labs / Blockaid Report)→mentioned with→Drift(85%)
- DPRK Crypto Theft H1 2026 (TRM Labs / Blockaid Report)→mentioned with→Bitcoin(70%)
- DPRK Crypto Theft H1 2026 (TRM Labs / Blockaid Report)→mentioned with→Ethereum(70%)
- Amnokgang Technology Development Company→mentioned with→Ethereum(70%)
- + 59 more
2 submissions awaiting moderator review.
Timeline(10 events)
September 2025
DPRK-linked UNC4736 operators allegedly began a multi-month social engineering campaign targeting Drift Protocol contributors, attending conferences and building Telegram-based relationships with employees.
The Hacker News / CoinDeskMarch 2026
DPRK proxies made in-person contact with Drift employees at crypto conferences and deposited over $1 million of their own funds into the protocol to appear as legitimate partners.
CoinDesk / BitPinas12 March 2026
OFAC sanctioned six individuals and two entities — including Amnokgang Technology Development Company — for facilitating DPRK IT worker networks that allegedly generated $800 million for weapons programs in 2024.
The Hacker News / CoinDeskApril 2026
Drift Protocol exploited for approximately $285 million in 12 minutes. Attackers executed pre-signed transactions after a zero-timelock governance migration removed the protocol's review window. Attributed to UNC4736 / Citrine Sleet.
The Hacker News / TRM Labs18 April 2026
KelpDAO rsETH LayerZero bridge drained of approximately $292 million (116,500 rsETH) in under 46 minutes. Attackers compromised internal RPC nodes and DDoS'd external nodes to poison the bridge's single DVN verifier. Attributed to TraderTraitor / Lazarus Group.
SecurityWeek / Chainalysis18 April 2026
KelpDAO paused contracts, preventing an additional alleged $95 million in losses. Arbitrum governance froze approximately $75 million of stolen funds on the Arbitrum network.
SpotedCrypto21 April 2026
KelpDAO hacker began moving approximately $175 million in stolen ETH through THORChain, converting proceeds to Bitcoin over roughly 36 hours. THORChain volume surged approximately 18 times its normal daily level.
Unchained / CryptoTimes8 June 2026
Humanity Protocol exploited for approximately $36 million via a phishing email impersonating Bithumb, installing spyware that exposed multisig bridge keys. Attributed to DPRK-affiliated groups by Quantstamp based on malware tooling.
CoinTelegraph / CryptoBriefing3 July 2026
TRM Labs published report attributing $643 million in H1 2026 crypto theft to North Korean hackers, representing approximately two-thirds of global crypto theft losses and 76% of YTD losses at time of April incidents.
TRM Labs / UPI29 July 2026
Blockaid published H1 2026 crypto security report documenting a record 212 exploits and $1.1 billion in total losses, attributing approximately $609 million (55% of total) to North Korea-linked groups.
Blockaid / CryptoTimesDecision Log
- slot 445508822 · hash GQccLWsvtER2RaSS3Js16AmUiwEhJPoepBseeRDmHtQD
- slot 443517968 · hash 95QftYjd9mfUGAuB7y8Jc3k2wRygnpQdQ1qnmdA4nTnK
- slot 443517957 · hash 2ZoYX31W5Gq8B1F8WzAbppimVWc3t2Wa9GC8Yca6k7T2
- slot 443503077 · hash NUcp8Av6qnyS8aEjpc33Xb3S5p25smAuDAMh1YFc8tF
This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 20 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 7/31/2026, 12:22:38 PM
last updated: 8/25/2026, 10:40:31 PM
8 viewsavoid.net — verified advice for a post-truth world