North Korean hackers dominate crypto theft in 2026 as DeFi losses fall

TRM Labs says North Korean hackers drove about two-thirds of worldwide crypto hacking losses in H1 2026, even as total losses dropped year-on-year. In the first six months, TRM recorded 207 hacks (a period high), but losses fell to $972M from $2.3B in H1 2025. North Korea-linked entities accounted for 66.2% of the $972M total (about $643M). Most of the damage came from two high-value DeFi breaches: a $285M Drift exploit in April and a $292M hack of KelpDAO. The latest data is still well below roughly $1.7B stolen by North Korea-linked actors in H1 2025, but it does not include non-hack theft such as phishing, social engineering, fraud, scams, and covert IT worker operations—so true illicit revenue may be higher. Attack patterns are shifting. TRM notes infrastructure/operational compromises are only ~15% of incidents but explain ~76% of total losses, while smaller smart-contract exploits are increasing in count. Earlier CertiK findings add that the “physical infiltration” and rapid laundering (e.g., stolen ETH quickly converted via exchanges/mixers) can worsen recovery risk for traders. For trading, persistent North Korean hackers targeting high-value DeFi increases ongoing DeFi security risk. Even with lower aggregate loss totals, expect headline-driven volatility around DeFi and broader on-chain sentiment, and treat token risk premiums as likely to stay elevated.