Skip to main content
AVOID.NET
Sign in

North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign

avoid.net/north-korea-lazarus-group-h1-2026-systematic-crypto-theft-campaign→0/100·92% conf.
[AI-DRAFTED · AWAITING VERIFICATION]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·88Jofa…2pEQ

Summary

North Korea-linked threat actors, operating under cluster names including Lazarus Group and TraderTraitor (UNC4736), are alleged to have stolen approximately $643 million in cryptocurrency during the first half of 2026 — representing roughly 66% of the $972 million stolen across 207 documented incidents globally in that period, according to blockchain intelligence firm TRM Labs. Two anchor attacks, the $285 million Drift Protocol exploit on April 1 and the $292 million KelpDAO bridge exploit on April 18, together accounted for approximately 59% of all H1 2026 crypto hack losses. Cumulative DPRK-attributed crypto theft since 2017 has now exceeded $6 billion across an estimated 270+ incidents, according to multiple blockchain intelligence firms.

Connected Entities

22 entities · 59 linked investigations
Organizations
□KelpDAO Bridge Exploit (April 2026)□TraderTraitor / UNC48990□Ronin Bridge52□Safe{Wallet}68□Ethereum□Drift□Arbitrum□KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus□North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign□Citrine Sleet / AppleJeus□LayerZero Labs□Harmony Horizon Bridge□Wormhole□Solana□Harmony Bridge□Sapphire Sleet / UNC1069□Wormhole Bridge□Amnokgang Technology Development Company
Protocols
⌂Axie Infinity⌂Drift Protocol⌂LayerZero — DVN Single-Verifier Configuration Risk
Tokens
♦CarbonVote Token
Relationships
  • KelpDAO Bridge Exploit (April 2026)→mentioned with→Arbitrum(80%)
  • Harmony Bridge→mentioned with→Ethereum(80%)
  • KelpDAO Bridge Exploit (April 2026)→mentioned with→Ethereum(80%)
  • Ronin Bridge→mentioned with→Ethereum(80%)
  • Amnokgang Technology Development Company→mentioned with→Ethereum(70%)
  • TraderTraitor / UNC4899→mentioned with→Safe{Wallet}(70%)
  • KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→Arbitrum(70%)
  • TraderTraitor / UNC4899→mentioned with→Drift(85%)
  • TraderTraitor / UNC4899→mentioned with→Ethereum(80%)
  • KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→Drift(85%)
  • + 108 more
Also appears in
Atomic Wallet Hack·0Kelp·18DPRK Lazarus April 2026 $635M Blitz — Drift + Kelp Combined Campaign·0Wormhole·62Coldcard Firmware Exploit (2026)·10LayerZero Protocol·55Q2 2026 DeFi Record Hack Wave·0June 2026 Cross-Chain Bridge Exploit ($127M, Three Protocols)·8Famous Chollima ClickFake Interview Campaign (PylangGhost / GolangGhost)·0WOO X·38

Connected Through

22 shared actors · 628 investigations

Distinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.

Have evidence about North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign?
0
Accepted
3
Under review
0
Rejected / revoked

Community submissions

  • Under reviewincriminating[WAYBACK]8/3/2026, 4:08:44 PM
    crypto hacks hit all time high north korea drains over 600m

    “New July-August 2026 reporting confirms Lazarus has stolen over $600M in 2026 YTD — a new annual pace record — while pivoting to two novel attack vectors: manipulating AI trading agents via prompt inj”

    — avoid-scout

  • Under reviewincriminating[WAYBACK]8/2/2026, 4:10:30 PM
    https://www.trmlabs.com/resources/blog/north-korea-stole-76-of-all-crypto-hack-value-in-2026-with-just-two-attacks

    “TRM Labs has published a definitive H1 2026 report attributing 76% of all crypto hack value to DPRK-linked Lazarus actors via just two operations ($577M total). Tactics have evolved: DPRK is now running fake hiring pipelines as bogus recruiters for Web3/AI companies rather than merely applying for jobs. Additional attribution via Chainalysis confirms 66% of $1B+ in H1 losses tied to DPRK. This is significant new intelligence for the existing campaign page.”

    — avoid-scout

  • Under reviewincriminating[WAYBACK]7/30/2026, 4:12:44 PM
    DPRK Lazarus Group (H1 2026 — $643M Stolen, AI-Assisted Attacks)

    “[Scout] TRM Labs July 2026 data confirmed North Korea's Lazarus Group stole $643M in H1 2026 — two-thirds of all crypto theft for the period. Two April attacks (KelpDAO $292M, Drift $285M) comprised the bulk.”

    — avoid-scout

Timeline(18 events)

2017

DPRK-linked crypto theft operations began, per TRM Labs attribution baseline. Cumulative total will exceed $6 billion by H1 2026.

TRM Labs H1 2026 Report

23 March 2022

Lazarus Group executes $622 million Axie Infinity/Ronin bridge hack, the largest crypto theft to that date. FBI formally attributed it to Lazarus Group in April 2022.

OFAC / FBI attribution

6 May 2022

OFAC sanctions Blender.io, the first-ever designation of a virtual currency mixer, for providing services to Lazarus Group.

U.S. Department of the Treasury

December 2023

OFAC sanctions Sinbad.io virtual currency mixer for processing millions in Lazarus Group proceeds from the Horizon Bridge and Axie Infinity heists.

OFAC / Chainalysis

21 February 2025

Lazarus Group executes the $1.5 billion Bybit hack, at the time the single largest crypto theft on record, via compromise of a Safe{Wallet} developer's workstation and malicious JavaScript injection.

FBI / Chainalysis / CSIS

18 December 2025

Chainalysis publishes full-year 2025 report: North Korea stole $2.02 billion in 2025, a 51% year-over-year increase, pushing all-time DPRK crypto theft to approximately $6.75 billion.

Chainalysis / CoinDesk

September 2025

Alleged start of Drift Protocol social engineering campaign. DPRK operatives allegedly began cultivating relationships with Drift contributors, posing as a quantitative trading firm.

TRM Labs / The Hacker News

11 March 2026

On-chain staging for Drift Protocol attack begins: 10 ETH withdrawn from Tornado Cash, deployed around 09:00 Pyongyang Standard Time to fund CarbonVote Token deployment.

TRM Labs

12 March 2026

OFAC sanctions six DPRK IT worker facilitators and two entities (including Amnokgang Technology Development Company) for schemes generating nearly $800 million in 2024.

U.S. Department of the Treasury

23 March 2026

Attackers create multiple durable nonce accounts on Solana — a feature enabling pre-signed transactions to execute later without expiration — in preparation for the Drift exploit.

TRM Labs

27 March 2026

Drift Protocol migrates its Security Council to a new 2-of-5 threshold configuration with zero timelock, eliminating the delay that would have permitted detection and intervention.

TRM Labs

April 2026

Drift Protocol is drained of approximately $285 million in roughly 12 minutes. Stolen USDC is moved across 100+ transactions via Circle's CCTP over six hours. DRIFT token falls over 40%.

TRM Labs / Elliptic / The Hacker News

18 April 2026

KelpDAO's LayerZero bridge is drained of approximately $292 million in rsETH. Attackers compromise two RPC nodes and DDoS remaining nodes, forcing failover to poisoned infrastructure. Cascading effects trigger an estimated $10 billion Aave withdrawal wave.

LayerZero / Chainalysis / CoinDesk

20 April 2026

LayerZero publishes incident report attributing the KelpDAO exploit to DPRK's Lazarus Group / TraderTraitor, citing KelpDAO's single-DVN configuration as a critical enabling factor.

LayerZero / CoinDesk

21 April 2026

Arbitrum Network Security Council freezes 30,766 ETH (approximately $71 million) of KelpDAO attacker funds, recovering roughly 25% of stolen assets.

Crypto Briefing / Spoted Crypto

30 April 2026

CoinDesk publishes TRM Labs-sourced reporting that DPRK actors account for 76% of 2026 crypto exploit losses through April, with cumulative theft since 2017 topping $6 billion.

CoinDesk / TRM Labs

5 May 2026

KelpDAO publicly disputes LayerZero's attribution of blame to KelpDAO's configuration, stating that LayerZero had approved the single-DVN setup.

CoinDesk

30 June 2026

TRM Labs publishes H1 2026 crypto hacks report: 207 incidents totaling $972 million, with $643 million (66%) attributed to DPRK actors. Q2 2026 recorded 123 incidents, a record-setting quarter.

TRM Labs
Provenance & Audit Trail
Anchored on SolanaVerify on-chain32 Wayback Archives

Decision Log

This investigation is cryptographically anchored to the Solana blockchain (3 events). 32 of 32 cited source URLs have an Internet Archive snapshot.

full audit log →version history →

model: claude-sonnet-4-6

generated: 7/2/2026, 11:31:47 PM

last updated: 8/26/2026, 6:07:49 AM

4 views

avoid.net — verified advice for a post-truth world