Crypto hacks surpass $1 billion in first half of 2024; North Korean groups responsible for most thefts

Cryptocurrency losses from hacks exceeded $1 billion in the first half of 2024, marking one of the most costly periods for the digital asset industry in recent years. According to blockchain security firm Blockaid, the majority of stolen funds were taken from projects built on Ethereum and Solana, two of the most widely used blockchain networks. North Korean-linked hacker groups accounted for roughly $600 million of the total, underscoring the persistent threat posed by state-aligned cybercriminal operations.

Breakdown of losses and affected platforms

Blockaid’s mid-year report, released this week, details that the $1.08 billion in total losses came from a combination of smart contract exploits, private key compromises, and phishing attacks. Ethereum-based decentralized finance (DeFi) protocols suffered the largest share of losses, followed by Solana-based projects. The data highlights a shift in attacker focus toward cross-chain bridges and liquid staking platforms, which often hold large pools of user funds in a single contract.

The report also notes that the scale of attacks in the first half of 2024 is roughly on par with the same period in 2023, suggesting that security improvements have not kept pace with the growth of total value locked in DeFi. Several major exploits in the first quarter, including a $200 million theft from a cross-chain bridge, contributed significantly to the total.

North Korea’s role in crypto theft

North Korean hacking groups, most notably Lazarus Group and its affiliates, have been linked to multiple high-value heists in 2024. Blockchain analytics firms have traced stolen funds through a series of mixing services and cross-chain swaps, making recovery difficult. The $600 million figure attributed to North Korean actors represents more than half of all crypto thefts in the period, continuing a trend observed since 2022.

U.S. and South Korean authorities have issued joint advisories warning crypto firms about North Korean IT workers infiltrating blockchain projects to gain access to private keys. Blockaid’s data supports these warnings, showing that several breaches involved insider access or social engineering tactics consistent with North Korean operational methods.

Impact on the broader crypto ecosystem

The persistent flow of stolen funds has multiple downstream effects. Exchanges and DeFi platforms face increased regulatory scrutiny, particularly around know-your-customer (KYC) and anti-money laundering (AML) compliance. Insurance premiums for crypto custody services have risen, and some projects now allocate significant portions of their treasury to security audits and bug bounty programs.

For retail investors, the risks are direct: hacks often result in permanent loss of funds, especially when smart contract vulnerabilities are exploited before patches can be deployed. The concentration of attacks on Ethereum and Solana also raises questions about the security models of the most active blockchain ecosystems.

Industry response and future outlook

In response to the rising threat, several blockchain security firms have launched real-time monitoring services that flag suspicious transactions before funds can be moved to exchanges. Law enforcement agencies, including the FBI and the U.S. Treasury’s Office of Foreign Assets Control (OFAC), have increased sanctions against wallets linked to North Korean hacking groups.

Despite these efforts, the pace of innovation among attackers continues to challenge defenders. The second half of 2024 will likely see further attempts at large-scale exploits, particularly targeting protocols that have not yet undergone rigorous third-party audits. For the crypto industry, the $1 billion milestone is a reminder that security remains the most critical factor for long-term adoption and trust.

Conclusion

The first half of 2024 has been a costly period for cryptocurrency holders, with losses from hacks exceeding $1 billion. North Korean-linked hackers remain the dominant threat, responsible for the majority of stolen funds. Ethereum and Solana projects bore the brunt of the attacks, highlighting vulnerabilities in DeFi infrastructure. While security measures are improving, the data from Blockaid suggests that the industry still has significant work to do in protecting user assets from increasingly sophisticated adversaries.

FAQs

Q1: Why are North Korean hackers targeting cryptocurrency projects?
North Korean hacking groups, such as Lazarus, are believed to steal cryptocurrency to fund the country’s weapons programs and bypass international sanctions. Crypto theft provides a relatively anonymous source of revenue compared to traditional banking systems.

Q2: Which types of crypto projects are most vulnerable to hacks?
DeFi protocols, cross-chain bridges, and liquid staking platforms are among the most targeted because they often hold large pools of user funds in smart contracts. Projects with unaudited code or weak private key management are especially at risk.

Q3: Can stolen cryptocurrency be recovered?
Recovery is difficult but not impossible. Blockchain analytics firms and law enforcement agencies can trace stolen funds through the blockchain, but once they are mixed through privacy tools or swapped across chains, recovery becomes highly unlikely. In some cases, recovered funds have been returned to victims after months of investigation.