North Korean Hackers Drove Most Crypto Losses Through Drift and KelpDAO Thefts

North Korea-linked hackers were attributed to two major cryptocurrency thefts in April: the $285 million Drift Protocol breach and the $292 million KelpDAO exploit, which together accounted for 76% of all crypto hack losses recorded through April 2026. TRM Labs said the operations fit Pyongyang’s established pattern of carrying out a small number of highly targeted, high-value intrusions rather than frequent lower-value attacks, pushing cumulative North Korea-attributed crypto theft above $6 billion since 2017.

The two attacks used different intrusion paths and laundering chains. In the Drift case, attackers reportedly spent months on social engineering, abused Solana durable nonce transactions, and leveraged a governance configuration change to drain funds in about 12 minutes. In the KelpDAO theft, the attackers allegedly exploited a single-verifier LayerZero bridge design after compromising internal RPC nodes and using DDoS pressure to force reliance on poisoned data. TRM said the stolen assets then moved along separate routes: Drift funds were bridged to Ethereum and left dormant, while KelpDAO proceeds were partly frozen on Arbitrum and the remainder rapidly flowed through THORChain into Bitcoin in a pattern resembling TraderTraitor operations, reinforcing THORChain’s role as a recurring laundering route in major North Korea-linked crypto heists.