The cryptocurrency market witnessed a significant surge in high-profile hacks in April 2026, resulting in staggering losses of over $650 million. According to CertiK, a leading blockchain security firm, the majority of these losses can be attributed to the exploits of KelpDAO and Drift Protocol, which lost $292 million and $285.2 million, respectively. These incidents have raised concerns about the increasing sophistication of hacking groups, particularly those originating from North Korea.
Experts believe that North Korean hacking groups have been using advanced tactics, including social engineering and AI-powered reconnaissance, to carry out precise and targeted exploits. This is evident in the Drift Protocol hack, which involved weeks of setup and months of social engineering to gain access to protocol signers. The funds were drained in a mere 12 minutes, highlighting the swiftness and efficiency of these attacks. Similarly, the KelpDAO hack exploited a single-verifier flaw in a LayerZero bridge, allowing attackers to move funds through THORChain after freezing over $70 million on Arbitrum.
The Rise of North Korean Hacking Groups
TRM Labs reports that North Korean hacking groups have been responsible for 76% of all crypto hack losses in 2026, with their share of total crypto theft steadily increasing over the years. From under 10% in 2020 and 2021 to 22% in 2022, 37% in 2023, 39% in 2024, and 64% in 2025, these groups have become a dominant force in the world of crypto hacking. The Bybit breach in 2025, which resulted in the loss of $1.46 billion, was a significant contributor to this trend. With their total crypto theft now crossing $6 billion since 2017, it is clear that these groups are becoming increasingly sophisticated and efficient in their operations.
The use of AI tools is believed to be a key factor in the enhancement of these hacking groups' tactics. By leveraging AI-powered reconnaissance and social engineering, they are able to carry out more precise and targeted exploits, resulting in higher losses for their victims. As the cryptocurrency market continues to evolve, it is essential for investors and market participants to remain vigilant and proactive in their efforts to prevent and mitigate these types of attacks.
