SBS News

News > Politics

"North Korea Behind It?" Shocking: Nearly 1 Trillion Won Stolen

Kim Hye-young

Published : Jul 3, 2026 2:44 PM


▲ The photo above is not related to the content of this article.

Approximately two-thirds of global cryptocurrency hacking losses in the first half of this year were attributed to North Korea-linked hacking groups, Voice of America (VOA) reported on Friday (July 3), citing a report by blockchain analysis firm TRM Labs.

According to the report, the total value of virtual assets stolen by North Korea-linked hacking groups in the first half of this year reached 643 million U.S. dollars, or approximately 989.9 billion Korean won.

This accounts for about 66 percent of the 972 million U.S. dollars (approximately 1.5 trillion won) in total global cryptocurrency hacking losses during the same period.

The report identified North Korea-linked groups as the perpetrators behind the 285 million dollar hack of the decentralized finance (DeFi) platform Drift in April, as well as the 292 million dollar hack of another DeFi platform, KelpDAO.

The losses from these two incidents alone total 577 million U.S. dollars, or approximately 900 billion Korean won.

The report noted that while the amount of virtual assets stolen by North Korea-linked hackers in the first half of this year decreased compared to the approximately 1.7 billion U.S. dollars (about 2.6 trillion won) stolen during the same period last year, it explained that this was "not because North Korea's attack capabilities have weakened, but because there were relatively fewer mega-scale hacking incidents this year compared to last year."

The report added, "These statistics only reflect North Korean hacking incidents and do not include illegal profits from phishing, cryptocurrency scams, or the disguised employment of overseas IT workers," noting that "North Korea's actual cryptocurrency-related revenue could be much larger than this."

Meanwhile, South Korea, the United States, and Japan held the 5th Trilateral Working Group Meeting on North Korean Cyber Threats in Washington, D.C., on June 25–26.

Regarding the meeting, a U.S. State Department spokesperson emphasized to VOA that "North Korea has increasingly turned to cybercrime to evade international sanctions and fund its unlawful weapons of mass destruction and ballistic missile programs," adding that "cryptocurrency theft and money laundering have become a significant part of this strategy."