The trajectory of North Korea's involvement in crypto theft is one of the most striking data trends in the history of the asset class. In 2020 and 2021, North Korean hacking groups accounted for less than 10% of total crypto hack losses. That figure climbed to 22% in 2022, then reached 37%, 39%, and 64% in the three years that followed. The 76% reading through April 2026 represents the highest sustained level ever recorded, and it arrived not because North Korea launched more attacks but because the attacks it chose to execute were catastrophically effective. TRM Labs explicitly notes that attack frequency has not increased. What has changed is the sophistication and scale of individual operations, with Pyongyang's top hacking teams running a small number of carefully selected high-value operations each year rather than a high volume of smaller ones.

North Korean hackers drained at least $2.02 billion in digital assets in 2025 alone, and the 2026 pace through April suggests the annual total could exceed that figure if the current trajectory continues. The pattern that has emerged over five years is of an adversary that has systematically studied and adapted to the crypto ecosystem, moving from relatively simple private key compromises in earlier years to the kind of multi-month social engineering and blockchain mechanism manipulation that characterized the Drift attack. For the crypto industry, the implication is that the threat model has fundamentally changed from opportunistic exploitation of technical vulnerabilities to sophisticated, patient, intelligence-driven operations that can compromise protocols from the inside before any on-chain activity reveals the attack is underway.