The recent six-month infiltration campaign at Drift has left the crypto industry reeling, but a more pressing question has emerged: why does North Korea continue to target crypto, and what makes its approach so unique? According to security experts, crypto provides the regime with a vital revenue stream, enabling it to stay afloat.
North Korea's urgency stems from its limited economic options, with comprehensive international sanctions in place and a need for hard currency to fund its weapons programs. Unlike other state-backed hackers, North Korea's approach is distinct, as it carries out large-scale, traceable heists on public blockchains rather than using crypto to quietly evade sanctions.
This is due to the country's lack of a functioning economy, which necessitates direct revenue through crypto theft. The regime's targets include exchanges, wallet providers, DeFi protocols, and individual engineers and founders with access to infrastructure. In contrast to Russia and Iran, which use crypto as a means to achieve broader geopolitical goals, North Korea's focus is singularly on stealing crypto.
This has led to the adoption of tactics more commonly associated with intelligence agencies, such as months-long relationship building and supply chain infiltration. The crypto industry's architecture makes it an attractive target, with a lack of safeguards at the protocol level, allowing for rapid and irreversible transactions.
The finality of crypto transactions fundamentally changes the security calculus, making prevention the only viable option. The gap in regulatory guidance and audit requirements between traditional banking and crypto projects creates an environment where even sophisticated teams can be vulnerable to long-term infiltration tactics. This poses the hardest operational security problem in crypto, with the industry still struggling to solve it.