The government of the Democratic People’s Republic of Korea (DPRK) has issued a formal rebuttal against international allegations linking the state to a series of high-profile cryptocurrency thefts, characterizing the claims as a coordinated campaign of "political slander." In a statement released on May 3, 2026, through the state-run Korean Central News Agency (KCNA), a spokesperson for the Ministry of Foreign Affairs dismissed recent reports from blockchain analytics firms and Western intelligence agencies as "baseless fabrications" designed to tarnish the country’s sovereign reputation. The ministry asserted that the United States and its allies are disseminating "false information" to justify hostile policies and sanctions, further claiming that it is the U.S. itself that poses the greatest threat to global cybersecurity through its dominance over international information technology infrastructure.
This official denial comes in the wake of a highly detailed investigative report published by TRM Labs, a leading blockchain intelligence firm. The report, which analyzed cyber-financial activity between January and April 2026, concluded that North Korea-linked hacking collectives were responsible for approximately 76% of all stolen cryptocurrency value globally during that period. According to TRM Labs, the total value of digital assets exfiltrated by these groups in the first four months of 2026 reached an estimated $577 million (approximately 90.5 billion yen). The stark contrast between the DPRK’s diplomatic assertions and the technical data provided by private-sector security firms highlights the deepening chasm between Pyongyang and the international community regarding the regulation of the digital frontier.
The TRM Labs Findings and the 2026 Surge in Cyber-Theft
The TRM Labs report, titled "North Korea Stole 76% of All Crypto Hack Value in 2026 with Just Two Attacks," provides a granular look at the evolving tactics of state-sponsored actors. The data indicates that while the total number of hacking incidents globally has seen fluctuations, the scale and precision of North Korean operations have intensified. The $577 million figure is particularly striking when compared to historical data; since 2017, cumulative losses attributed to North Korea-linked actors have exceeded $6 billion (940 billion yen).
The report highlights a significant trend: the concentration of high-value targets. In 2022, North Korea-linked groups were estimated to be responsible for roughly 22% of global crypto thefts. By 2025, that figure rose to 64%, and the preliminary data for 2026 suggests that their share of the illicit market has grown to more than three-quarters of the total value stolen. This trajectory suggests that the DPRK has shifted its focus from high-frequency, low-value attacks to sophisticated, large-scale breaches of decentralized finance (DeFi) protocols and centralized exchanges.
Chronology of the 2026 Attacks: Drift Protocol and KelpDAO
The majority of the $577 million stolen in early 2026 can be traced to two specific security breaches that occurred in April. These incidents demonstrate the speed and technical proficiency with which these actors operate, often bypassing multiple layers of security within minutes.
On April 1, 2026, the Drift Protocol, a decentralized exchange operating on the Solana blockchain, was targeted in a sophisticated exploit. Investigators determined that the attackers managed to manipulate the protocol’s liquidity pools, resulting in the drainage of approximately $285 million (450 billion yen) in various digital assets. Analysts from multiple cybersecurity firms identified signatures in the code and the subsequent laundering patterns that were consistent with "TraderTraitor," a known subgroup of the infamous Lazarus Group.
Less than three weeks later, on April 18, 2026, KelpDAO, a liquid restaking protocol, suffered a similar fate. In this instance, the attackers exploited a vulnerability in the protocol’s smart contract logic to authorize unauthorized withdrawals. The total value lost in the KelpDAO breach was estimated at $292 million (460 billion yen). Together, the Drift and KelpDAO attacks accounted for only 3% of the total number of hacking incidents in 2026, yet they represented 76% of the total financial damage, underscoring the "whale-hunting" strategy currently employed by North Korean cyber units.
The Role of the Lazarus Group and TraderTraitor Sub-Units
International law enforcement agencies, including the U.S. Federal Bureau of Investigation (FBI) and the Department of Justice (DOJ), have long maintained that the Lazarus Group serves as the primary cyber-warfare arm of the DPRK’s Reconnaissance General Bureau (RGB). Within this umbrella organization, specialized units like "TraderTraitor" have been identified as the vanguard of financial cyber-crime.
The TraderTraitor group specifically targets employees of cryptocurrency exchanges and blockchain development firms through sophisticated phishing campaigns. These campaigns often involve the use of fraudulent job offers or malware-laden technical documents delivered via professional networking platforms. Once a single employee’s device is compromised, the group moves laterally through the corporate network to gain access to private keys or administrative privileges.
The FBI previously confirmed TraderTraitor’s involvement in the February 2025 hack of the Bybit exchange, which resulted in the loss of $150 million. The persistence of this specific sub-unit throughout 2025 and into 2026 suggests a high degree of institutional knowledge and a refined methodology for targeting the Web3 ecosystem.
Infiltration of the Web3 Workforce: The "Shadow Army"
Beyond direct hacking, North Korea has expanded its operations into the realm of corporate infiltration. A growing body of evidence suggests that hundreds of North Korean IT workers are successfully securing remote employment at Western technology firms, particularly within the cryptocurrency and DeFi sectors. These workers use stolen or forged identities, often posing as developers from Japan, South Korea, or Southeast Asia.
In early 2026, the "ETH Rangers" program—a community-led security initiative supported by the Ethereum Foundation—identified approximately 100 IT workers suspected of having ties to the DPRK. These individuals had successfully embedded themselves into various Web3 projects, gaining access to sensitive codebases and internal communication channels. While not all of these workers are involved in active theft, their salaries are reportedly remitted to the North Korean government, providing a steady stream of hard currency that bypasses international sanctions.
The U.S. Department of Justice has taken aggressive steps to dismantle these support networks. On April 15, 2026, two American nationals were sentenced to 108 months and 92 months in prison, respectively, for their roles in facilitating the fraudulent employment of North Korean remote IT workers. The defendants were found to have provided "laptop farms" and domestic IP addresses to help the workers maintain their digital disguises.
International Sanctions and Law Enforcement Responses
The escalating threat has prompted a multifaceted response from global regulators. On March 12, 2026, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced a new round of sanctions targeting six individuals and two entities linked to the DPRK’s IT worker schemes. OFAC estimated that these schemes generated approximately $800 million (1,250 billion yen) for the North Korean regime in 2024 alone.
In a report submitted to the U.S. Congress, the Treasury Department estimated that North Korean hackers had successfully laundered approximately $2.8 billion (4,400 billion yen) in stolen cryptocurrency over the past two years. The laundering process has become increasingly complex, involving the use of "mixers" like Tornado Cash (despite its sanctioned status) and "chain-hopping" techniques where assets are rapidly moved across different blockchains to obscure the audit trail.
The United Nations Security Council (UNSC) has also voiced concern, with its Panel of Experts repeatedly stating that cyber-theft has become a "vital lifeline" for the DPRK’s nuclear and ballistic missile programs. Estimates suggest that up to 50% of the country’s foreign currency earnings are now derived from cyber-operations.
Broader Implications and the Future of Blockchain Security
The North Korean Ministry of Foreign Affairs’ denial of these activities is viewed by geopolitical analysts as a standard diplomatic maneuver intended to maintain plausible deniability while continuing its lucrative cyber-offensive. However, the sheer volume of technical evidence—ranging from on-chain data to forensic analysis of malware—makes the "political slander" defense increasingly difficult to sustain in the eyes of the international community.
For the cryptocurrency industry, the 2026 data serves as a stark reminder of the persistent security risks inherent in decentralized systems. As North Korean actors continue to refine their "whale-hunting" tactics, the pressure on DeFi protocols to implement more robust security measures, such as multi-signature requirements for all treasury movements and mandatory third-party audits, has reached a critical point.
The ongoing battle between state-sponsored cyber-units and international law enforcement is likely to define the regulatory landscape of the digital asset market for years to come. While North Korea continues to assert its innocence on the world stage, the movement of hundreds of millions of dollars across the blockchain tells a different story—one of a state-led enterprise that has successfully turned the burgeoning world of digital finance into a cornerstone of its national defense and economic survival. The expansion of the "containment network" through sanctions, judicial action, and industry-led defense initiatives represents the most significant effort to date to close the digital loopholes that have allowed these activities to flourish.
