Teoram logo
Teoram
Predictive tech intelligence
peakingstabilizingCrypto & Web3

North Korea's crypto heist playbook is expanding and DeFi keeps getting hit

More than $500 million was siphoned across the Drift and Kelp exploits in just over two weeks. What once looked like isolated breaches now resembles a sustained campaign, likely driven by the financial needs of a sanctioned state.

What is happening

North Korea's crypto heist playbook is expanding and DeFi keeps getting hit

Theme activity is concentrated now, with momentum and confidence both elevated.

Momentum
81%
Confidence trend
89%0
First seen
21 Apr 2026, 8:55 am
Narrative formation start
Last active
20 Apr 2026, 9:17 pm
Latest confirmed movement
Supporting signals

Evidence that is shaping the theme

These clustered signals are the repeated pieces of reporting that formed the theme. Read them as the evidence layer beneath the broader narrative.

Crypto & Web3Confidence 95%2 sources20 Apr 2026, 9:17 pm

North Korea's crypto heist playbook is expanding and DeFi keeps getting hit

More than $500 million was siphoned across the Drift and Kelp exploits in just over two weeks. What once looked like isolated breaches now resembles a sustained campaign, likely driven by the financial needs of a sanctioned state.

CoinDeskTechBuzz AI
Crypto & Web3Confidence 95%3 sources20 Apr 2026, 9:17 pm

North Korea's crypto heist playbook is expanding and DeFi keeps getting hit

More than $500 million was siphoned across the Drift and Kelp exploits in just over two weeks. What once looked like isolated breaches now resembles a sustained campaign, likely driven by the financial needs of a sanctioned state.

CoinDeskTechBuzz AITechCrunch
Related articles

Research briefs behind this theme

Open the article-level analysis that gives this theme its evidence, timing, and scenario framing.

Crypto & Web3Research Briefmedium impact

North Korea's crypto heist playbook is expanding and DeFi keeps getting hit

Multiple trusted reports are pointing to the same directional technology shift, suggesting the market should read this as a category signal rather than isolated headline activity.

What may happen next
Prediction says this signal will translate into sharper competitive positioning over the next two quarters.
Signal profile
Source support 60% and momentum 70%.
High confidence | 95%2 trusted sourcesWatch over 2 to 6 weeksmedium business impact
Crypto & Web3Research Briefmedium impact

Cybersecurity Alert: North Korean Hackers Targeting macOS and Crypto Users

As North Korean hacking activities evolve with AI-enhanced methodologies, both individual users and enterprises in the cryptocurrency space must adopt advanced cybersecurity measures to mitigate risks associated with these targeted attacks.

What may happen next
The increasing use of AI in cyberattacks will likely result in more frequent and sophisticated breaches in the crypto landscape, particularly among macOS users.
Signal profile
Source support 60% and momentum 48%.
High confidence | 95%2 trusted sourcesWatch over 12-18 monthsmedium business impact
Crypto & Web3Research Brieflow impact

Bitcoin Trades Near $69,000 as Weak Sentiment Keeps Crypto Market in Check

Multiple trusted reports are pointing to the same directional technology shift, suggesting the market should read this as a category signal rather than isolated headline activity.

What may happen next
Prediction says this signal will translate into sharper competitive positioning over the next two quarters.
Signal profile
Source support 45% and momentum 48%.
Developing confidence | 76%1 trusted sourceWatch over 2 to 6 weekslow business impact
North Korea's crypto heist playbook is expanding and DeFi keeps getting hit Trend Analysis & Market Signals | Teoram | Teoram