> ## Content Index
> Fetch the complete content index at: https://www.russianhackers.co/llms.txt
> Use this file to discover other available public pages before exploring further.

# Crypto Theft Fell to $972M in H1 2026, but North Korea's Share Climbed to Two-Thirds
- URL: https://www.russianhackers.co/crypto-theft-h1-2026-972m-north-korea-share/
- Published: 2026-07-16T20:00:23.000Z
- Updated: 2026-07-16T20:05:57.000Z
- Author: Martin
- Tags: News, Hackers

In the first half of 2026, attackers stole about $972 million from the cryptocurrency industry across 207 incidents, according to a mid-year report from analytics firm TRM Labs. The figure is down by more than half from the same period in 2025, when losses were put at $2.3 billion.

Despite the overall decline, the share tied to North Korea has actually grown. Analysts attribute roughly $643 million, about 66% of the half-year total, to the Lazarus Group and its TraderTraitor subunit. Almost all of that came from two April attacks on DeFi protocols: the roughly $292 million KelpDAO breach and the $285 million hit on Drift Protocol. By available accounts, the first was a supply chain attack and the second turned on social engineering.

North Korea's share is nonetheless lower than a year earlier, when about $1.7 billion in H1 2025 was attributed to the DPRK. Even so, by cumulative volume Pyongyang remains the single largest source of crypto theft in the world, with linked groups having drained an estimated $6 billion since 2017.

The drop in the overall total owes less to stronger defenses than to the absence in the first half of a mega-heist on the scale of last year's Bybit breach. The number of incidents itself remains high, and the leading causes of loss are still private key compromise, social engineering, and smart contract vulnerabilities.

*Based on reporting by TRM Labs.*