North Korea behind two-thirds of crypto stolen in first half of 2026, report finds

TRM Labs reported Friday that North Korea-linked groups stole $643 million in crypto in H1 2026, or 66.2% of the $972 million lost globally.koreaherald+1
The regime's haul declined from 2025's record $2 billion but remained concentrated in major attacks, including a $285 million Drift platform breach.sedaily+1
G7 leaders in June elevated North Korean crypto theft to a top security concern alongside nuclear proliferation for the first time.binance+1

North Korean-linked hacking groups stole approximately $643 million in cryptocurrency during the first half of 2026, accounting for about two-thirds of all crypto funds stolen worldwide, according to a report released Friday by blockchain analysis firm TRM Labs.koreaherald+2

The $643 million represented 66.2 percent of the $972 million in total global crypto hack losses during the January-June period, the report found. While the figure marks a decline from 2025's record pace — when North Korean actors stole over $2 billion for the year — TRM Labs dismissed any suggestion that Pyongyang's capabilities have weakened.sedaily+2

A Concentrated Threat

Much of North Korea's 2026 haul came from a small number of large attacks. Through April alone, just two hacks — including a $285 million breach of the decentralized finance platform Drift — accounted for 76 percent of all crypto theft losses globally, according to an earlier TRM Labs analysis. The concentration of losses in a handful of incidents reflects the sophistication of North Korea's state-backed cyber units.sedaily+1

The findings build on a pattern of escalating activity. In 2025, North Korean hackers pulled off the largest single crypto theft in history — a $1.5 billion breach of the Bybit exchange in February, which the FBI attributed to Pyongyang. TRM Labs estimated that North Korea-linked groups have stolen nearly $3 billion in cryptocurrency since 2017.trmlabs+1

G7 Elevates Crypto Crime as Security Concern

The scale of Pyongyang's cyber operations has drawn increasing international attention. At their summit in Évian-les-Bains, France, on June 17, G7 leaders included North Korea's cryptocurrency thefts in their joint geopolitical statement for the first time, placing the issue alongside nuclear proliferation and the war in Ukraine as a top security concern.binance+2

"We reiterate the need to jointly address North Korea's cryptocurrency thefts and cybercrimes," the leaders stated.news.bitcoin

A now-disbanded United Nations panel previously estimated that illicit cyber activity accounts for roughly 40 percent of North Korea's weapons program funding. With international sanctions limiting Pyongyang's access to legitimate revenue, cryptocurrency theft has become a central pillar of the regime's financial strategy — one that governments are only beginning to confront collectively.ajupress

Sources (14)