North Korea Denies Cryptocurrency Theft Allegations
In a bold denial, North Korea has dismissed claims that it is involved in cryptocurrency theft, despite emerging data that links the nation to a significant portion of global hacking losses for early 2026. A recent report from TRM Labs indicated that operatives associated with the North Korean government were responsible for approximately $577 million in stolen cryptocurrency between January and April of this year, representing an astounding 76% of hacking losses worldwide during that timeframe.
Details of the Hacking Incidents
This surge in theft appears to be fueled predominantly by two major incidents in April, which included a staggering $292 million breach of KelpDAO and an $285 million attack on Drift Protocol.
Responding to these allegations, the Korean Central News Agency relayed comments from a North Korean Foreign Ministry spokesperson, who labeled the claims as “absurd slander” and asserted that they are part of a broader strategy by the United States to legitimize its hostile policies towards the DPRK.
The spokesperson further criticized the U.S., stating that it is unreasonable for Washington—characterized as possessing advanced cyber capabilities—to portray itself as the “world’s greatest victim.” North Korea vowed to take “all necessary measures” to protect its interests.
Escalating Trends in Cryptocurrency Theft
The data from TRM Labs suggests a troubling trend; North Korea’s share of global cryptocurrency theft has escalated significantly, increasing from less than 10% in 2020 and 2021 to 64% in 2025, and now reaching an alarming 76% in the first quarter of 2026. Cumulatively, crypto theft attributed to North Korea has surpassed $6 billion since 2017.
Notably, TRM Labs has attributed the KelpDAO hack to an operation linked to the infamous Lazarus Group, while the specifics of the Drift Protocol breach remain under investigation.
Impact of North Korean Cyber Operations
The majority of hacking incidents have been dominated by these large breaches, with only around 3% of total hacking cases so far in 2026 being responsible for these massive financial losses. Moreover, earlier insights from TRM Labs, referenced by media outlet The Block, have noted that North Korean cyber operations have gained efficiency due to advancements in their hacking tools and money laundering techniques, driven by a state-mandated push to circumvent economic sanctions through digital currencies.
This analysis has also pointed to recurrent attacks aimed at cryptocurrency exchanges, decentralized finance (DeFi) platforms, and cross-chain infrastructures.
Global Concerns and Sanctions
Further complicating the narrative, a United Nations report recently indicated that the digital assets stolen by North Korean entities play a crucial role in financing the country’s nuclear and ballistic missile programs, heightening global apprehension regarding the regime’s actions.
In a related context, the U.S. Department of the Treasury sanctioned six individuals and two organizations on March 13, 2024, linked to North Korean IT operations that collectively raked in nearly $800 million, comprising networks that facilitated cryptocurrency transactions and converted funds into digital currencies.
