North Korea's Crypto Hackers Drain Over $600M in 17 Days

Crypto hacks have reached an all-time high in the first six months of 2026, according to Blockaid's H1 2026 Security Report. The report found that 212 verified hack incidents resulted in over $1.1 billion in losses, with North Korea's state-sponsored hacking apparatus responsible for roughly 55% of every dollar stolen.

The most notable incident occurred when North Korea drained over $600 million from cryptocurrency projects in a 17-day window in April 2026. The attacks targeted Drift Protocol and KelpDAO, where attackers exploited the humans who controlled protocols rather than finding bugs in smart contracts.

In the Drift attack, threat actors affiliated with UNC4736 posed as representatives of a legitimate quantitative trading firm, meeting Drift contributors at an industry conference to build credibility. They deposited over $1 million into the protocol and used Solana's durable nonce feature to pre-authorize administrative transactions months before acting on them.

The KelpDAO attack required no social engineering, only that a single verifier stand between an attacker and $292 million. The attackers compromised LayerZero Labs' verification infrastructure by gaining access to two RPC nodes, replacing the software with malicious versions that reported fabricated data.