North Korea-linked hacking groups stole roughly $577 million from two major exploits in 2026 — the Drift and KelpDAO incidents — and laundered the funds through a well-worn playbook that relies on speed, cross-chain bridges, and no-KYC swaps. According to blockchain analytics firm TRM Labs, about 66% of all crypto hack losses in the first half of 2026 were tied to Democratic People's Republic of Korea (DPRK) actors.
The laundering playbook
The pattern is consistent. Attackers drain a protocol, then immediately move stolen assets across cross-chain bridges and into no-KYC decentralized exchanges. These tools act as the primary “blur” to break source-chain heuristics. Once the funds are consolidated into stablecoins, the window for freezing them narrows from hours to just minutes.
After that, the stablecoins are cashed out via over-the-counter (OTC) brokers, often in China, who convert them into U.S. dollars and Chinese yuan. The transfers are intentionally split into small amounts to avoid triggering compliance flags. Recent arrests linked to North Korea have highlighted this exact cash-out route.
Why the first hour is critical
The first hour after an exploit is the only realistic window for freezing stolen funds. Once attackers bridge to another chain and swap into stablecoins, the opportunity vanishes. They then split the loot into smaller packets across multiple wallets before reconsolidating — a tactic that further complicates tracking.
Mixers are still used occasionally, but their effectiveness has been reduced due to sanctions and shrinking pool sizes. The primary tools now are cross-chain bridges and no-KYC swaps, which offer faster and less traceable movement.
The role of OTC brokers
OTC brokers are the final link in the chain. They convert stablecoins to fiat currency — predominantly USD and yuan — via Chinese brokers. The transactions are deliberately kept small to stay under reporting thresholds. This method has been observed in multiple DPRK-linked heists and was cited in recent arrests.
TRM Labs flagged this laundering route as dominating the largest 2026 heists. The Drift incident accounted for $285 million, and the KelpDAO incident for $292 million. Together, they represent a significant portion of the $577 million total.
What’s next
Law enforcement and blockchain analytics firms continue to monitor these patterns, but the window for intervention remains extremely narrow. The question now is whether exchanges and bridge operators can tighten their controls fast enough to keep pace with the speed of DPRK-linked laundering operations.
