North Korea's $577M Crypto Heist Hits Bitcoin ETFs Hard

TL;DR

North Korean state hackers stole a record 76% of all 2026 crypto hack losses using just two precision attacks: $285 million from Drift Protocol on Solana (April 1) and $292 million from KelpDAO (April 18). Blockchain security firm TRM Labs published full attribution on May 1, confirming months of in-person social engineering and laundering via THORChain. Simultaneously, US spot Bitcoin ETFs bled $490 million over three consecutive trading days through April 29, driven by the Federal Reserve holding rates at 3.50%-3.75% with no rate-cut signal. BTC entered May 1 trading around $75,600, down roughly 3% from its recent range near $77,000.

What Happened: North Korea's Crypto Heist Strategy

TRM Labs' mid-year threat intelligence report, published this morning, reveals that North Korean hacking groups linked to the Reconnaissance General Bureau now account for 76% of all 2026 crypto hack value through April. That share has climbed every year since 2020, from under 10% then to 64% in 2025 and now 76% in 2026.

Two attacks explain nearly all of it.

The Drift Protocol breach on April 1 netted $285 million from the Solana-based perpetual exchange. TRM analysts describe it as unprecedented: North Korean proxies held in-person meetings with Drift employees over several months before the attack. Staging on the Solana network began March 11. When the attackers moved, they exploited a compromised deployer key with no timelock or multisig protection and drained the protocol in approximately 12 minutes.

The KelpDAO exploit on April 18 took a different technical path. Attackers targeted a single-verifier design flaw in a LayerZero cross-chain bridge and extracted $292 million. A portion was frozen on Arbitrum, but the majority was routed through THORChain -- the same decentralized protocol used to convert Bybit hack proceeds (Lazarus Group, February 2025) into Bitcoin. No THORChain operator froze or rejected the transfers.

Combined, the two attacks bring North Korea's cumulative crypto theft since 2017 to over $6 billion, according to TRM Labs. The group is not attacking more frequently. It is targeting more precisely, picking fewer but larger victims and executing more sophisticated operational security.

A follow-on effect emerged yesterday. Wasabi Protocol, a Solana-based protocol, reported a $4.5 million admin-key compromise on April 30 using the same playbook as Drift. CoinDesk noted the attack appeared to copy the Drift blueprint directly. Carrot, a Solana yield protocol, shut down entirely on April 30 as the first confirmed secondary casualty of the Drift exploit fallout.

Why Markets Moved: ETF Outflows and the Macro Headwind

The TRM Labs report landed on top of an already pressured Bitcoin market. US-listed spot Bitcoin ETFs (exchange-traded funds) recorded three straight days of net outflows between April 27 and April 29, totaling approximately $490 million:

April 27: $263.2 million (largest single-day withdrawal)
April 28: $89.7 million
April 29 (Fed decision day): $137.6 million

Fidelity's FBTC led the selling at $191.5 million, followed by BlackRock's IBIT at $166.9 million and ARK's ARKB at $73.3 million. The outflow run reversed a nine-day inflow streak worth $2.1 billion.

The trigger on April 29 was the Federal Reserve's decision to hold its benchmark interest rate at 3.50%-3.75% for the third consecutive meeting, with Fed Chair Jerome Powell giving no signal of near-term cuts. Separately, the US 30-year Treasury yield hit 5%, raising the opportunity cost of holding risk assets like Bitcoin. BTC ended the week at approximately $75,621, down around 3% from its $77,000 range earlier in April.

This comes in the context of a broader macro backdrop shaped by the Iran war and Strait of Hormuz disruption -- covered in detail in our prior flash post -- which has already been weighing on risk sentiment across asset classes. Geopolitical uncertainty, high energy costs, and a hawkish Fed are converging pressures that make it harder for Bitcoin to sustain rallies above key resistance levels.

Implications for Traders

Crypto and DeFi participants: The Drift and KelpDAO hacks expose two recurring failure modes. Single-key deployer access with no timelock remains exploitable even in high-value protocols. Cross-chain bridges with single-verifier designs continue to be DeFi's widest attack surface. Protocols with similar architecture should be treated as elevated risk until independently audited. Short-term capital migration out of Solana DeFi is a plausible outcome as confidence resets.

Bitcoin and ETF traders: Three-day outflows of $490 million after a $2.1B inflow cycle represent a meaningful institutional recalibration, not a panic. Bitcoin's $74,000-$76,000 zone coincides with what on-chain analytics firm CryptoQuant identifies as the cost-basis cluster for current-cycle buyers. A sustained hold above this zone supports the bull case; a close below $73,500 would shift the structure.

Futures traders: BTC perpetual funding rates went negative in late April, indicating leveraged longs were already being squeezed before the ETF outflows hit. Combined with a weak spot bid, conditions favor range-bound choppiness over a clean directional move in the near term. Watch for funding rates normalizing as a potential early signal of the next leg.

Potential Positives vs Negatives

Positives:

TRM Labs attribution may accelerate regulatory pressure on THORChain and similar bridges, which could reduce their attractiveness for laundering and improve long-term ecosystem credibility.
BTC near $75,000 is drawing institutional interest. Survey data cited by CoinEdition shows 75% of polled institutions currently view BTC as undervalued at these levels.
ETF outflow cycles in prior periods have been brief; the structural demand behind the 9-day inflow run has not disappeared.
Clearing over-leveraged longs through negative funding creates a cleaner technical setup for the next move higher.

Negatives:

DeFi insecurity at the $285M-$292M scale erodes confidence in on-chain capital formation and undermines the broader DeFi adoption narrative.
The Fed's rate-hold stance and 5% long-bond yields reduce the macro tailwind for speculative assets.
THORChain's repeated role in laundering sanctioned funds increases protocol-level regulatory risk for any project connected to it.
A break below $74,000 would mark the first decisive close below the major cost-basis cluster for 2026 buyers and could accelerate mechanical selling.

What Could Happen From Here

Base case (40-45% probability): BTC holds the $74,000-$76,000 support zone. ETF outflows stabilize after 3-4 days. Bitcoin consolidates in a $73,000-$79,000 range through mid-May. DeFi capital stratifies further between audited multisig-secured protocols and legacy single-key designs. Confirmed if ETF flows turn flat-to-positive within 2 sessions and BTC does not close below $74,000.

Upside case (25-30% probability): Institutional buyers step in at $74,000-$75,000, triggering a short squeeze on negative-funded perpetuals and a recovery toward $80,000 or higher. This scenario is reinforced if ETF net inflows return within 3 sessions, BTC reclaims $77,000 on strong spot volume, and funding rates turn positive again.

Downside case (25-30% probability): BTC breaks below $74,000 on continued ETF outflows, further Fed tightening signals, or additional large DeFi exploits. A weekly close below $73,500 opens a retest of the $68,000-$70,000 range. Confirmed if multiple consecutive ETF outflow days exceed $200 million and BTC loses the $74,000 level on volume above recent average.

What to Watch Next (24 Hours)

Bitcoin ETF flow data for May 1 from Farside Investors -- fourth consecutive outflow day vs. stabilization.
BTC price action around the $74,500-$75,500 zone during US morning trading.
Any OFAC, FBI, or CISA statement following TRM Labs' North Korea attribution report.
THORChain governance or community response to its repeated role in laundering sanctioned funds.
Additional Solana DeFi protocol advisories in the wake of Carrot's shutdown and the Wasabi exploit.
US 30-year Treasury yield direction -- further rise above 5% would add macro pressure on all risk assets.

FAQ

Why does North Korea steal cryptocurrency? Cryptocurrency theft is widely assessed by Western intelligence agencies as a primary revenue source for the North Korean government, funding weapons programs while circumventing international sanctions. TRM Labs estimates North Korea has stolen over $6 billion in crypto since 2017, with the pace accelerating sharply in 2025 and 2026.

What is THORChain and why does it keep appearing in these hacks? THORChain is a decentralized cross-chain protocol that allows users to swap assets across blockchains without a centralized intermediary. North Korean hackers have used it repeatedly to convert stolen ETH and stablecoins into Bitcoin, which is more difficult for authorities to freeze. Because THORChain is decentralized, no single operator can easily block specific transactions, making it a preferred tool for laundering large stolen sums.

Sources

---

The Drift and KelpDAO hacks are a reminder that fast-moving markets reward pattern recognition and disciplined risk control, not reaction. Build real skills, not bad habits. Whether you are trading BTC futures, managing DeFi exposure, or reading the macro setup, ChartDojo's AI-powered feedback helps you review your trades, identify recurring mistakes, and develop a genuine edge. Start your free trial today.

Header image source: pexels by David McBee. License: PEXELS.

North Korea Drained $577M in Crypto: Drift Hack, KelpDAO, and the Bitcoin ETF Exodus