Crypto: North Korea in the sights of a coordinated G7 response

The G7 wants to strengthen the international response against crypto thefts attributed to North Korea. Meeting in Évian, its leaders placed this cyber threat among their major security concerns, after several massive attacks hitting decentralized finance in 2026.

Crypto enters the G7 security agenda

G7 leaders have called for coordinated action against North Korean crypto thefts and cybercrime. This position continues the discussions already initiated around North Korean hacks during the previous summit organized in Canada.

The political message is hardening. Digital asset thefts are no longer treated as simple computer crimes. They are now linked to the circumvention of sanctions, the financing of the North Korean state and the development of its military programs.

This development changes the place of crypto in diplomatic discussions. The sector is becoming both a global financial infrastructure and a terrain of confrontation between States. Flaws in protocols can thus have consequences well beyond the investors directly affected.

Drift and Humanity illustrate the new threat

The attack on Drift Protocol marked a turning point. The Solana-based protocol lost around $286 million on April 1. Elliptic and TRM Labs have identified several clues consistent with operations previously attributed to groups linked to Pyongyang.

The operation was not based solely on a technical flaw. The attackers allegedly prepared their offensive for several months, created fake profiles and established relationships with members of the project. This patience shows that the North Korean crypto threat now exceeds traditional hacking.

Humanity Protocol subsequently lost almost $36 million. According to Quantstamp's investigation, a fake email imitating the Bithumb platform led an employee to install malware. The hackers then obtained sensitive access and private keys.

The incident caused a sharp fall in the H token. It serves as a reminder that human error remains one of the main entry points for crypto attacks, even when smart contracts have been audited.

A response based on tracing funds

The G7 will not be able to stop these operations with a simple declaration. An effective response requires faster intelligence sharing between governments, blockchain analytics companies and crypto platforms.

Suspicious addresses should be reported immediately. Exchanges can then block certain deposits or prevent the conversion of stolen funds into traditional currencies. Speed ​​remains essential, as hackers often move assets between multiple blockchains within hours.

G7 countries could also increase their pressure on jurisdictions hosting uncooperative platforms. Mixing services, offshore intermediaries and exchanges without sufficient controls further complicate tracking of funds.

Blockchain, however, offers investigators an advantage. Transactions remain public and can be tracked long after an attack. Hackers use complex techniques to cover their tracks, but their movements always leave digital traces.

International coordination remains the real challenge

North Korea-linked actors are believed to have stolen more than $6.5 billion in crypto over the past few years. Part of this revenue would be used to support the regime's military programs, according to several governments and cybersecurity companies.

Pyongyang regularly rejects these accusations. The North Korean government denounces narratives fabricated by the United States to justify sanctions. This opposition makes any direct cooperation impossible and forces the G7 to act through financial infrastructure.

The success of this strategy will therefore depend on the platforms, stablecoin issuers and cybersecurity companies. Authorities can sanction addresses, but funds will continue to flow if certain intermediaries refuse to cooperate.

The G7 now wants to transform its warnings into an operational mechanism. The challenge will be to hit criminal networks without weakening the entire crypto ecosystem. Faced with the proliferation of North Korean agents, security no longer depends solely on the code. It also requires human controls, better monitoring of recruitment and constant international cooperation.