North Korea-linked hackers steal $643M in crypto in H1 2026

Recovery rates remain low. North Korean operators move stolen funds through bridges, mixing services and other laundering methods that complicate tracing once the initial theft window closes, security analysts said. The $643 million figure covers only direct hacks and exploits, not revenue from parallel phishing schemes or fake job postings that North Korean operatives also run.

Cumulative North Korean crypto thefts since 2017 now exceed $6 billion, according to researchers who track the groups. The Lazarus Group's methods have evolved from relatively crude exchange hacks to operations that combine social engineering, custom malware and supply chain compromises with deep knowledge of DeFi protocol architecture.

The concentration of losses in DeFi and bridge infrastructure points to a specific risk for anyone holding capital on decentralized platforms. Two protocols lost nearly $600 million because their signer security and bridge architecture were not hardened against nation-state attackers. Before committing funds, investors need to examine multisig configurations and signer operational security and ask whether the protocol has undergone security audits that model state-sponsored threats, security researchers said. The next attack could target a similar setup.