North Korea and crypto hacks: accusations denied while data point to billions stolen

Recent data provided by TRM Labs attribute to North Korea a dominant share of global crypto hacks in the first months of 2026.

However, Pyongyang’s official response rejects all accusations, calling them a groundless political fabrication.

At the heart of this confrontation there is not only a technical issue, but a broader dynamic concerning the role of cryptocurrencies in economic conflicts and state strategies.

TRM Labs links Pyongyang to 76% of 2026 crypto hacks

According to the most recent analyses, actors linked to North Korea allegedly stole around 577 million dollars in cryptocurrencies between January and April 2026. This figure would represent about 76% of global losses due to hacks in the same period.

This figure is particularly significant when compared with previous years. In 2020 and 2021, in fact, the share attributed to the country was below 10%.

In 2025 it had already risen above 60%, showing a steady growth both in terms of operational capacity and economic impact.

This concentration suggests that the attacks are not evenly distributed, but dominated by a few large-scale incidents. The most significant exploits, such as those that hit DeFi protocols and cross-chain systems, contributed decisively to the total.

One of the most controversial elements concerns the attribution of the attacks. TRM Labs links some operations to specific groups, such as those associated with the so-called Lazarus Group, already known for cyber activities on a global scale.

These attributions are based on technical analyses, behavioral patterns and tracking of money flows. However, definitively proving the direct involvement of a State remains complex.

As anticipated, North Korea has firmly rejected the accusations, calling them “absurd defamation” and claiming that they are a political tool used by the United States to justify pressure and sanctions.

This response reflects a typical dynamic of digital conflicts, where the line between technical evidence and political interpretation is often thin.

In any case, one of the key points of the debate concerns the use of cryptocurrencies as a tool to circumvent international sanctions. Several reports indicate that digital assets stolen through cyberattacks may be used to finance state programs.

According to some analyses, cryptocurrencies offer an alternative to traditional financial systems, allowing value to be transferred across borders without going through controlled intermediaries.

The evolution of hacking techniques and international responses

In recent years, crypto attacks have become increasingly sophisticated. They are not limited to technical vulnerabilities in protocols, but include complex strategies that combine exploits, social engineering and advanced laundering techniques.

The stolen funds are often split and transferred through multiple wallets and platforms, making tracking difficult. In addition, the use of cross-chain systems and mixing services further increases the complexity.

This evolution indicates that the actors involved have significant resources and skills: these are no longer opportunistic attacks, but structured operations.

Faced with this situation, international authorities are stepping up countermeasures. The United States has already introduced sanctions against individuals and entities linked to hacking and laundering schemes.

These actions aim to limit the operational capacity of the groups involved and to reduce their access to global financial systems. However, the effectiveness of these measures remains a subject of debate.

Cryptocurrencies, by their very nature, make it difficult to completely block money flows. Even with sanctions and controls, determined actors can in fact find alternative ways to operate.

Not only that, the case also highlights another problem: the difficulty of distinguishing between objective data and political narratives. Technical analyses provide important indications, but they can be interpreted in different ways depending on the context.

On the one hand, security companies and authorities try to build a coherent framework based on evidence. On the other, the States involved contest these interpretations, creating a confrontation that goes beyond the technical dimension.

This makes the debate more complex, because every piece of information can also be read in strategic terms.

Implications for the crypto sector

For the world of cryptocurrencies, this situation represents a significant challenge. The growth of the sector is accompanied by increased attention from regulators and authorities.

Large-scale attacks fuel the perception of risk and can influence political decisions. At the same time, they highlight the need to improve the security and resilience of systems.

The sector therefore finds itself in a delicate position, between innovation and responsibility.

In any case, the confrontation between North Korea and TRM Labs is unlikely to find an immediate solution. The technical evidence will continue to be analyzed, while political tensions will remain in the background.