Crypto Hack Losses Hit $750M+ in 2026 as North Korea Dominates Attacks
Crypto hack statistics for 2026 reveal escalating losses, with over $750 million stolen by April 19, driven by North Korean state-linked groups. April 2026 became the worst month on record, with $629.69 million drained, 95% from two Lazarus-linked attacks on Drift Protocol and KelpDAO. The Drift Protocol hack on April 1 saw $270–285 million stolen via a six-month social engineering campaign by UNC4736. The KelpDAO exploit on April 18 resulted in $292 million lost through a LayerZero bridge message spoofing, triggering a bank run on Aave that saw $6 billion in TVL exit. North Korean hackers accounted for 76% of all crypto stolen in 2026, with cumulative theft since 2017 surpassing $6 billion. Attack vectors shifted from code exploits to social engineering, which caused $290 million in Q1 2026 alone. Cross-chain bridges remain a structural weakness, with $2.9 billion in cumulative losses since 2022. The data comes from Chainalysis, DefiLlama, PeckShield, TRM Labs, and other sources.
Key facts
- Crypto hack losses reached $3.4 billion in 2025, the highest annual total on record.
- April 2026 set a record as the worst month in crypto history with $629.69 million stolen.
- North Korean state-linked hackers stole 76% of all crypto stolen in 2026 via two attacks totaling $577 million.
- The Drift Protocol hack on April 1, 2026, resulted in $270–285 million stolen by UNC4736.
- The KelpDAO exploit on April 18, 2026, caused $292 million in losses via LayerZero bridge spoofing.
- Social engineering and phishing caused $290 million in losses in Q1 2026, more than all other attack types combined.
- Cross-chain bridges have accumulated over $2.9 billion in cumulative losses since 2022.
- North Korea's cumulative crypto theft since 2017 has surpassed $6 billion.
Entities
Institutions
- Chainalysis
- DefiLlama
- PeckShield
- TRM Labs
- Lazarus Group
- UNC4736
- Drift Protocol
- KelpDAO
- Aave
- LayerZero
- Bybit
- Coinbase
- BtcTurk
- Nobitex
- Phemex
- Balancer
- DMM Bitcoin
- Immunefi
- Coinlaw
- Bank Policy Institute
- Travers Smith
- Metamask
- MEXC
- Crowdfund Insider
- BeInCrypto
- The Block
- UPI
- Coindesk
- AMBCrypto
- Crystal Intelligence
- Webopedia
- IndexBox
- GNcrypto
- The Currency Analytics
- Sherlock
- Cryip.co
- Cryptoimpacthub.com
- Phemex.com
- NFT Plazas
- Solana
- Galaxy Research
- Morpho
- Spark
- Lido
- Yearn
- Beefy
- Rhea Finance
- Tether
- Grinex
- SunSwap
- CoW Swap
- Hyperbridge
- Polkadot
- Wasabi Protocol
- DeFi United
- Arbitrum Security Council
- CertiK
Locations
- Dubai
- United Arab Emirates
- Iran
- Turkey
- North Korea
- Solana
- Ethereum
- Arbitrum
- Stellar
- Base
- IoTeX
- Kyrgyzstan
- Ethereum mainnet
Sources
- NFT Plazas —
- NFT Plazas —