North Korea-Linked Hackers Have Drained Over $600 Million in Crypto in 2026
Myth: crypto hacking in 2026 is mostly opportunistic criminals exploiting sloppy code. Reality: a meaningful share of this year’s biggest thefts trace back to a single, well-resourced, state-linked operation with years of practice.
North Korea-linked hacking groups have drained more than $600 million in cryptocurrency during 2026 alone, according to security researchers tracking blockchain-based theft this year, contributing significantly to a broader total of roughly $1.3 billion in crypto hacking losses across the industry so far in 2026.
These groups have built a track record over several years of specifically targeting cryptocurrency exchanges, DeFi protocols, and individual holders, using techniques ranging from sophisticated social engineering aimed at employees with system access, to fraudulent job applications designed to place operatives inside crypto companies, to direct technical exploitation of smart contracts and custody infrastructure.
What’s changed in the pattern this year, according to researchers, is a shift toward fewer but more surgical attacks — rather than opportunistically hitting many smaller targets, resources are increasingly concentrated on fewer operations designed to extract larger sums per incident.
A newer trend researchers are flagging specifically: AI agents and automated trading or custody systems becoming fresh targets, as more crypto infrastructure incorporates AI-driven decision-making. An AI agent with access to funds or private keys represents a potentially exploitable attack surface that didn’t meaningfully exist in earlier years.
The stolen funds are widely believed to help finance North Korea’s weapons programs, based on assessments from multiple national governments over several years, which is part of why these attacks draw sustained attention from law enforcement and sanctions authorities well beyond the immediate financial loss to victims.
Want to understand the security fundamentals that protect against this kind of attack? Learn more in the Bitcoin Academy.