Key takeaways

• North Korean hackers, from two distinct groups, stole approximately USD 577 million in 2026 YTD — 76% of all crypto hack losses through April, across just a handful of attributed incidents.
• The Drift Protocol hack (USD 285 million, April 1) involved three weeks of pre-attack staging and months of  social engineering to compromise protocol signers, executing the full drain in approximately 12 minutes.
• The KelpDAO hack (USD 292 million, April 18) exploited a single-verifier design flaw in a LayerZero bridge, then laundered proceeds through THORChain after USD 75 million was frozen on Arbitrum.
• The two attacks show diverging laundering playbooks: Drift, after an initial cross-chain speedrun to Ethereum, is dormant; KelpDAO…