Topic 9 stories, 14 hacks, 5 agency actions, 2018–2026
North Korea
Thefts that incident records link to North Korea’s Lazarus Group, and the US charges and sanctions aimed at its crypto operations.
2026
- OFAC sanctioned facilitators of North Korean IT worker fraud, listing crypto addresses, plus Rwandan entities supporting M23.OFAC
- What happened after the North Korea DeFi warning: Bybit, Tornado Cash, 71 addressesLook-back
- Q2 2026 in crypto hacks: Drift and Kelp lost $588 million within 17 daysLook-back
- Kelp: $293.0m lostHack
- Drift Trade: $295.0m lostHack
- OFAC sanctioned facilitators of North Korean IT worker fraud, listing crypto addresses, alongside Hamas-linked charity designations.OFAC
2025
- Crypto addresses on the US sanctions list: 77 added in 2024, 165 in 2025Look-back
- OFAC sanctioned North Korean bankers and institutions involved in laundering cybercrime proceeds and IT worker funds, listing USDT addresses.OFAC
- Q3 2025 in crypto hacks: no loss passed $50 million, but exchanges lost $175 millionLook-back
- SBI Crypto: $21.0m lostHack
- OFAC sanctioned two individuals and two entities tied to a DPRK IT worker fraud network, listing a bitcoin address for one designee.OFAC
- Four North Korean nationals charged with posing as remote IT workers to steal and launder over $900,000 in virtual currency.DOJ
- Q2 2025 in crypto hacks: a code flaw at Cetus led $549.6 million in lossesLook-back
- BitoPro: $11.5m lostHack
- Q1 2025 in crypto hacks: Bybit’s $1.40 billion made up 86.8% of the quarterLook-back
- Bybit: $1.40bn lostHack
2024
2023
2022
2021
2020
2019
2018
Hacks come from the failures ledger and agency actions from the enforcement ledger, which starts in 2024. An action is listed when its announcement mentions North Korea. Being mentioned doesn't mean a company did anything wrong. Look-backs were written later and sit under the period they cover.