Drift

Arbitrum

LayerZero

Ronin

Tornado

<p><strong>North Korea has come out to deny allegations that the regime is responsible for crypto thefts and “all cyber-related frauds.”</strong></p>
<div>
 The rebuttal comes just less than a week after blockchain intelligence firm TRM Labs published its findings, which tied North Korean state-sponsored to 76% of all crypto lost to hackers so far this year.
</div>
<div>
 ​
</div>
<div>
 A spokesperson for North Korea’s Foreign Ministry called the allegations an “absurd slander” being spread by the U.S. “government organs, reptile media organs and plot-breeding organizations” for political purposes.
</div>
<div>
 ​
</div>
<div>
 In the report Sunday, the spokesperson said it’s quite unreasonable for the U.S., which portrays itself as the world’s best cyber technical power, to claim the victim, while <a href="https://www.cryptopolitan.com/lazarus-group-malware-kit-macos-crypto-execs/" rel="noopener noreferrer nofollow">blaming the DPRK</a> for all cyber-related frauds. It is “an extension of the U.S. hostile policy toward the DPRK,” the spokesperson added.
</div>
<div>
 ​
</div>
<div>
 The spokesperson ended by saying North Korea will actively pursue all necessary measures to defend its interests.
</div>
<h3 id="trm-labs-says-north-korean-hackers-have-stolen-577m-this-year">TRM Labs says North Korean hackers have stolen $577M this year</h3>
<div>
 TRM Labs’ <a href="https://www.trmlabs.com/resources/blog/north-korea-stole-76-of-all-crypto-hack-value-in-2026-with-just-two-attacks" rel="noopener noreferrer nofollow">report</a> Thursday particularly linked <a href="https://www.cryptopolitan.com/cambodia-north-korea-state-crypto-crimes/" rel="noopener noreferrer nofollow">North Korean hackers</a> to the Drift Protocol and KelpDAO bridge exploit, all happening in April. The losses totaled $577 million, accounting for 76% of all crypto lost in hacks in just 2026.
</div>
<div>
 ​
</div>
<div>
 Data shows the share of crypto theft by North Korean actors has steadily increased since 2020, from under 10% to 64% in 2025, and now 76% in just the first four months of the year.
</div>
<div>
 <figure class="wp-caption alignnone"><img src="https://www.cryptopolitan.com/wp-content/uploads/2026/05/69f0d445529f920d06280a87_e28cd206.png" alt="North Korea rebuts TRM Labs report of $577 million crypto theft" width="1920" height="1101">
  <figcaption>
   Share of crypto losses to DRPK. Source TRM Labs
  </figcaption>
 </figure>
</div>
<div>
 ​The Drift Protocol hack involved months of <a href="https://www.cryptopolitan.com/north-korea-hackers-deepfake-hack-firms/" rel="noopener noreferrer nofollow">social engineering</a>, including what TRM described as in-person meetings between North Korean proxies and Drift employees.
</div>
<div>
 ​
</div>
<div>
 On-chain staging began on March 11 with a withdrawal from Tornado Cash, according to TRM Labs. The attacker exploited a Solana feature called a durable nonce to pre-sign transactions, then executed 31 withdrawals in roughly 12 minutes on April 1, leading to $285 million in losses.
</div>
<div>
 ​
</div>
<div>
 The KelpDAO breach exploited a single-verifier design flaw in a LayerZero bridge. After Arbitrum froze roughly $75 million of the stolen funds, the attackers pivoted to laundering through THORChain, converting stolen ETH to Bitcoin, with losses reaching $292 million.
</div>
<div>
 ​
</div>
<div>
 TRM Labs attributed KelpDAO’s exploit to TraderTraitor, a Lazarus Group-affiliated operation, and says another North Korean group distinct from TraderTraitor was responsible for Drift Protocol’s exploit.
</div>
<h3 id="u-s-bodies-tie-north-korean-actors-to-ronin-bybit-hacks">U.S. bodies tie North Korean actors to Ronin, Bybit hacks</h3>
<div>
 Over the past years, there have also been official reports by U.S. government agencies linking North Korean hackers to major crypto hacks.
</div>
<div>
 ​
</div>
<div>
 In February 2025, the Federal Bureau of Investigation (FBI) released a PSA categorically saying North Korea’s TraderTraitor was responsible for Bybit’s $1.5 billion hack earlier in the month. North Korea’s Lazarus Group was also attributed with the $615 million Ronin Network hack.
</div>
<div>
 ​
</div>
<div>
 The FBI had also issued an official report, saying the DPRK actors were responsible for hundreds of millions of dollars in cryptocurrency lost in 2023, from projects including Stake and Harmony’s Horizon Bridge.
</div>
<div>
 ​
</div>
<div>
 In other news, Cryptopolitan <a href="https://www.cryptopolitan.com/north-korea-creditors-target-kelp-dao-funds/" rel="noopener noreferrer nofollow">reported</a> that plaintiffs holding nearly $877 million in unpaid U.S. court judgments against North Korea filed a restraining notice on April 30 to block the Arbitrum DAO from moving approximately $71 million in frozen ETH linked to the KelpDAO exploit.
</div>
<p>Still letting the bank keep the best part? Watch our free video on <a href="https://www.cryptopolitan.com/defi-passive-income-training-video/?utm_source=syndication&amp;utm_medium=inlineads&amp;utm_campaign=defioptin" rel="noopener noreferrer nofollow">being your own bank</a>.</p>

North Korea has rejected allegations of sponsoring crypto thefts

Table of Contents

Cryptopolitan_News

Other articles published on May 4, 2026

Join our free newsletter for daily crypto updates!