North Korean hackers have stolen cryptocurrency assets exceeding $6 billion., 2026/05/02 10:11:29

The total value of cryptocurrency stolen by hackers from North Korea over the past nine years has surpassed $6 billion, according to experts from the cybersecurity platform TRM Labs.

In the first four months of this year, the amount of cryptocurrency taken by hacking groups from North Korea increased by approximately $577 million, TRM Labs reported. The company’s analysts clarified that this figure pertains only to a few incidents that have been reliably linked to North Korean groups.

One of the most significant incidents was the April 1 attack on the Drift protocol, during which hackers stole over $270 million. Security experts noted that the perpetrators prepared for the operation for three weeks, employing elements of social engineering for several months prior. The actual draining of the accounts took only 12 minutes.

Another major incident occurred on April 18, when the Kelp DAO platform was hacked, resulting in damages of around $292 million. The hackers exploited a vulnerability in the architecture of the LayerZero bridge. Following the attack, part of the stolen funds was laundered through the THORChain protocol, although the Arbitrum security council managed to freeze approximately $75 million in crypto assets on related addresses.

TRM Labs believes that THORChain plays a crucial role in the laundering of stolen funds by North Korean hackers. The protocol has processed a significant portion of the proceeds from both recent attacks and earlier incidents, including the Bybit hack in 2025, converting hundreds of millions of dollars in assets for North Korea into Ethereum and Bitcoin.

Previously, MetaMask security expert Taylor Monahan reported that North Korean specialists have been infiltrating cryptocurrency companies and decentralized finance (DeFi) projects for at least seven years, many of which have been targeted for hacking and theft of funds.