TRM Labs: North Korea took 76% of 2026 crypto hack losses with two April exploits

North Korea–linked hackers drove 76% of crypto hack losses through April 2026, per TRM Labs. Two April hits totaled about $577 million and skewed the year’s tally TRM Labs.

Those two cases made up roughly 3% of incidents. Yet they accounted for 76% of value stolen, a pattern TRM says has held since 2017: fewer attacks, bigger payouts TRM Labs.

• April 1, Drift Protocol: $285 million taken. Attackers staged for about three weeks, ran months of social engineering against signers, then drained funds in roughly 12 minutes TRM Labs.
• April 18, KelpDAO bridge: $292 million lost. Exploit hit a single‑verifier design in a LayerZero bridge. Afterward, funds moved via THORChain (RUNE) after more than $75 million was frozen on Arbitrum (ARB) TRM Labs.

TRM charts a rising DPRK share of hack losses. Under 10% in 2020 and 2021. Then 22% in 2022, 37% in 2023, 39% in 2024, and 64% in 2025. The 76% through April 2026 is the highest sustained share on record TRM Labs.

April set a separate record by count. It was the most‑hacked month in crypto history by number of incidents, per DeFiLlama DeFiLlama.