North Korea rejects cybercrime claims as DeFi losses rise

North Korea’s Foreign Ministry described allegations of state-backed cybercrime as “absurd slander” and accused U.S. government bodies and other organizations of spreading an “incorrect understanding of the DPRK.” The ministry said Washington had claimed victim status while controlling global information-technology infrastructure and accused it of carrying out indiscriminate cyber operations.

The ministry added: “One common point in their unilateral assertion is that all cyber-related frauds in different parts of the world are related to us and that the U.S. boasting of the world’s best cyber technical power is the world’s greatest victim.”

Blockchain forensics report different findings. TRM Labs reported that actors linked to the DPRK were responsible for roughly 76% of recorded crypto hack losses in 2026 through April. The firm tied separate groups to the Drift and KelpDAO DeFi exploits; combined losses for those incidents were about $577 million.

U.S. authorities have linked last year’s large Bybit breach, valued at about $1.5 billion, to a North Korea-linked group identified as “TraderTraitor.” Investigators found some stolen assets were converted into Bitcoin and dispersed across many addresses to complicate tracing.

Research funded by the Ethereum Foundation and carried out by the Ketman Project identified about 100 individuals suspected of working for North Korean IT units. The investigation reported operatives used forged identities and AI-generated profiles to gain access to 53 crypto projects and pose as legitimate contributors.

Regulatory action followed. In March, the U.S. Office of Foreign Assets Control imposed sanctions on six people and two entities tied to alleged schemes that placed DPRK IT workers inside crypto projects. The sanctions target service providers and financial networks that investigators say facilitate the conversion and movement of stolen digital assets.

The Foreign Ministry reiterated that protecting national cyberspace is an official policy and framed the allegations as part of broader hostility aimed at damaging the country’s reputation. “The DPRK will never tolerate the hostile forces’ attempt at confrontation getting more undisguised in various domains including cyber space, but actively take all necessary measures for defending the interests of the state and protecting the rights and interests of its citizens,” the ministry stated.