North Korean hacking groups were responsible for 76% of all crypto hack losses recorded through April 2026, according to a new report from TRM Labs, and the scale of that dominance came from precision rather than volume. Two attacks attributed to North Korean actors, the Drift Protocol breach on April 1 and the KelpDAO bridge exploit on April 18, together accounted for approximately $577 million in stolen assets. Despite representing just 3% of total incident count across all crypto hacks in the period, these two operations drove the overwhelming majority of dollar losses. The Drift exploit cost the Solana-based perpetual exchange $285 million and was revealed to be the outcome of a six-month intelligence operation.

The KelpDAO hack drained 116,500 rsETH worth roughly $292 million, making it the largest DeFi exploit of 2026 so far, with the Lazarus Group's TraderTraitor unit identified as the likely actor.The fallout from both attacks extended well beyond the directly targeted protocols. The Drift breach triggered contagion across multiple affiliated projects, with Solana yield platform Carrot announcing its permanent shutdown on April 30 after its TVL collapsed 93% as a direct consequence. The KelpDAO exploit sent Aave's total value locked plunging and spread instability across the broader DeFi lending market, prompting the coordinated DeFi United recovery effort that ultimately attracted over $215 million in pledged contributions. Two attacks, two months, and the entire landscape of Solana and Ethereum DeFi felt the consequences.