ARTFEED — Contemporary Art Intelligence

Crypto Hack Losses Hit $750M+ in 2026 as North Korea Dominates Attacks

other · 2026-05-02

Crypto hack statistics for 2026 reveal escalating losses, with over $750 million stolen by April 19, driven by North Korean state-linked groups. April 2026 became the worst month on record, with $629.69 million drained, 95% from two Lazarus-linked attacks on Drift Protocol and KelpDAO. The Drift Protocol hack on April 1 saw $270–285 million stolen via a six-month social engineering campaign by UNC4736. The KelpDAO exploit on April 18 resulted in $292 million lost through a LayerZero bridge message spoofing, triggering a bank run on Aave that saw $6 billion in TVL exit. North Korean hackers accounted for 76% of all crypto stolen in 2026, with cumulative theft since 2017 surpassing $6 billion. Attack vectors shifted from code exploits to social engineering, which caused $290 million in Q1 2026 alone. Cross-chain bridges remain a structural weakness, with $2.9 billion in cumulative losses since 2022. The data comes from Chainalysis, DefiLlama, PeckShield, TRM Labs, and other sources.

Key facts

  • Crypto hack losses reached $3.4 billion in 2025, the highest annual total on record.
  • April 2026 set a record as the worst month in crypto history with $629.69 million stolen.
  • North Korean state-linked hackers stole 76% of all crypto stolen in 2026 via two attacks totaling $577 million.
  • The Drift Protocol hack on April 1, 2026, resulted in $270–285 million stolen by UNC4736.
  • The KelpDAO exploit on April 18, 2026, caused $292 million in losses via LayerZero bridge spoofing.
  • Social engineering and phishing caused $290 million in losses in Q1 2026, more than all other attack types combined.
  • Cross-chain bridges have accumulated over $2.9 billion in cumulative losses since 2022.
  • North Korea's cumulative crypto theft since 2017 has surpassed $6 billion.

Entities

Institutions

  • Chainalysis
  • DefiLlama
  • PeckShield
  • TRM Labs
  • Lazarus Group
  • UNC4736
  • Drift Protocol
  • KelpDAO
  • Aave
  • LayerZero
  • Bybit
  • Coinbase
  • BtcTurk
  • Nobitex
  • Phemex
  • Balancer
  • DMM Bitcoin
  • Immunefi
  • Coinlaw
  • Bank Policy Institute
  • Travers Smith
  • Metamask
  • MEXC
  • Crowdfund Insider
  • BeInCrypto
  • The Block
  • UPI
  • Coindesk
  • AMBCrypto
  • Crystal Intelligence
  • Webopedia
  • IndexBox
  • GNcrypto
  • The Currency Analytics
  • Sherlock
  • Cryip.co
  • Cryptoimpacthub.com
  • Phemex.com
  • NFT Plazas
  • Solana
  • Galaxy Research
  • Morpho
  • Spark
  • Lido
  • Yearn
  • Beefy
  • Rhea Finance
  • Tether
  • Grinex
  • SunSwap
  • CoW Swap
  • Hyperbridge
  • Polkadot
  • Wasabi Protocol
  • DeFi United
  • Arbitrum Security Council
  • CertiK

Locations

  • Dubai
  • United Arab Emirates
  • Iran
  • Turkey
  • North Korea
  • Solana
  • Ethereum
  • Arbitrum
  • Stellar
  • Base
  • IoTeX
  • Kyrgyzstan
  • Ethereum mainnet

Sources