SEOUL, July 03 (AJP) - North Korea-linked hackers stole about $643 million in cryptocurrency in the first half of 2026, accounting for roughly two-thirds of all funds taken in crypto hacks during the period, according to a new report by blockchain intelligence firm TRM Labs.
The findings underscore Pyongyang’s continued reliance on cyber theft as a source of hard currency even as overall losses from cryptocurrency hacks fell sharply from a year earlier.
TRM Labs said attackers carried out 207 crypto hacks and exploits from January through June, the highest number the firm has recorded in any six-month period. Total losses, however, fell to $972 million, less than half the $2.3 billion stolen in the first half of 2025, the report said.
The decline reflected the absence of a theft on the scale of last year’s $1.5 billion Bybit hack, which the FBI attributed to North Korea. But TRM warned that the lower dollar figure should not be read as evidence that the crypto ecosystem has become safer.
“North Korea’s activity has not slowed,” the firm said in the report.
“The difference is that the rest of the ecosystem experienced fewer large scale thefts than in 2025.”
Nearly all of the North Korea-linked losses in the first half came from two attacks in April, TRM said. A breach of Drift Protocol caused about $285 million in losses, while an exploit targeting KelpDAO accounted for about $292 million. Together, the two attacks represented about $577 million in stolen funds.
TRM described the incidents as state-directed financial operations involving sophisticated infrastructure compromises rather than opportunistic smart-contract exploits.
The report pointed to a split in the threat landscape. Smart-contract exploits made up most of the hacks, with 125 of the 207 incidents recorded in the first half. But the largest losses came from attacks on infrastructure, credentials and systems used to control digital assets.
Infrastructure and operational compromises accounted for about 76 percent of all funds stolen while representing only about 15 percent of incidents, TRM said. By contrast, smart-contract attacks drove the record number of hacks but accounted for a much smaller share of the stolen value.
The median crypto hack in the first half caused about $219,000 in losses, while the average loss was $4.7 million, a gap that TRM said reflected the distorting effect of a few large attacks.
The FBI said in February 2025 that North Korea was responsible for the theft of about $1.5 billion in virtual assets from Bybit, a Dubai-based cryptocurrency exchange. The bureau identified the activity as TraderTraitor and said the stolen assets were being converted and dispersed across thousands of addresses on multiple blockchains.
U.N. sanctions monitors and U.S. officials have said North Korea uses cyberattacks and other illicit financial activity to help fund its nuclear weapons and missile programs while evading international sanctions. North Korea has previously denied allegations of hacking and other cyberattacks.
Other blockchain analytics firms have reached similar conclusions about the scale of the threat. Chainalysis said in December that North Korean hackers stole at least $2.02 billion in cryptocurrency in 2025, pushing their cumulative crypto theft total to at least $6.75 billion.
TRM said the $643 million attributed to North Korea-linked hacks in the first half of 2026 covers only hacks and exploits, not other illicit crypto activity such as phishing, fraud, scams, social engineering or covert information technology worker operations.
The report said crypto firms should continue auditing smart contracts because code exploits remain the most common attack type. But it said companies holding large amounts of digital assets also need stronger controls around key management, signing infrastructure, approval workflows and custody systems.
“Large infrastructure compromises continue to drive the industry’s biggest financial losses, while a growing number of smaller smart contract exploits are pushing incident counts to record levels,” TRM said.
Copyright ⓒ Aju Press All rights reserved.
