- 67
- 8
The total value of cryptocurrency stolen by North Korean hackers over nine years has exceeded $6 billion, according to experts at the cybersecurity platform TRM Labs.
In the first four months of this year, the volume of cryptocurrency stolen by North Korean hacker groups increased by approximately $577 million, TRM Labs reported. The company's analysts clarified that this only reflects a handful of incidents that have been reliably linked to North Korean groups.
One of the most notable episodes was the April 1 attack on the Drift protocol, which resulted in hackers stealing over $270 million. According to security experts, the attackers had been planning the operation for three weeks, and had been using social engineering techniques for several months prior. The actual depletion of accounts took just 12 minutes.
The next major incident was the April 18 hack of the Kelp DAO platform, which resulted in losses of approximately $292 million. The hackers exploited a vulnerability in the LayerZero bridge architecture. Following the attack, the attackers laundered some of the funds through the THORChain protocol, although the Arbitrum Security Council managed to freeze approximately $75 million in crypto assets held at related addresses.
TRM Labs believes that THORChain plays a key role in laundering stolen funds by North Korean hackers. The protocol processed a significant portion of the proceeds from both recent attacks and earlier incidents, including the Bybit hack in 2025, converting hundreds of millions of dollars' worth of assets into Ether and Bitcoin for North Korea.
In the first four months of this year, the volume of cryptocurrency stolen by North Korean hacker groups increased by approximately $577 million, TRM Labs reported. The company's analysts clarified that this only reflects a handful of incidents that have been reliably linked to North Korean groups.
One of the most notable episodes was the April 1 attack on the Drift protocol, which resulted in hackers stealing over $270 million. According to security experts, the attackers had been planning the operation for three weeks, and had been using social engineering techniques for several months prior. The actual depletion of accounts took just 12 minutes.
The next major incident was the April 18 hack of the Kelp DAO platform, which resulted in losses of approximately $292 million. The hackers exploited a vulnerability in the LayerZero bridge architecture. Following the attack, the attackers laundered some of the funds through the THORChain protocol, although the Arbitrum Security Council managed to freeze approximately $75 million in crypto assets held at related addresses.
TRM Labs believes that THORChain plays a key role in laundering stolen funds by North Korean hackers. The protocol processed a significant portion of the proceeds from both recent attacks and earlier incidents, including the Bybit hack in 2025, converting hundreds of millions of dollars' worth of assets into Ether and Bitcoin for North Korea.