North Korean-linked hackers stole $577 million from two DeFi platforms in April, accounting for 76% of all crypto hack losses in 2026, according to TRM Labs.
The attacks targeted Drift Protocol and Kelp DAO, with exploits worth $285 million and $292 million respectively, highlighting increasing precision in state-backed crypto operations.
TRM analysts said the Drift attack involved months of preparation including in-person social engineering, while the Kelp DAO exploit relied on a blockchain bridge verification flaw.
The Drift exploit used a Solana durable nonce feature to execute 31 withdrawals in minutes, while stolen funds were later moved to Ethereum and remain largely dormant.
In contrast, the Kelp DAO attack compromised internal RPC nodes and manipulated a single verifier, enabling the theft of 116,500 rsETH before partial funds were frozen by Arbitrum authorities.
Since 2017, North Korean actors have stolen more than $6 billion in crypto, with their share of total hack activity rising sharply from under 10% in 2020 to 76% so far in 2026.
The laundering of stolen funds has increasingly relied on cross-chain platforms like THORChain, which processed large volumes of illicit transfers without enforcing identity checks.
Analysts warn the growing sophistication of these attacks, potentially enhanced by AI-driven reconnaissance, signals an escalating systemic risk to decentralised finance infrastructure.
At the time of reporting, Solana price was $82.92.