A recent six-month infiltration campaign by North Korean hackers at Drift has raised concerns about the crypto industry's vulnerability to state-sponsored attacks. Unlike other nations, North Korea relies heavily on crypto to generate revenue due to its isolated economy and stringent international sanctions. According to Dave Schwed, chief operating officer at SVRN, 'North Korea doesn't have the luxury of patience...
They need hard currency to fund weapons programs.' The regime's hackers have been carrying out large-scale, traceable heists on public blockchains to gain immediate access to liquid value. This approach differs from other state-backed hacking operations, such as those conducted by Russia and Iran, which use crypto as a payment rail to evade sanctions. North Korea's focus on crypto as a target has led to the adoption of tactics typically associated with intelligence agencies, including months-long relationship building and supply chain infiltration. The crypto industry's lack of traditional financial safeguards, such as compliance checks and settlement delays, makes it an attractive target for North Korean hackers.
The finality of crypto transactions means that stopping an attack before it happens is essentially the only option, and the industry's emphasis on speed and innovation over governance and controls creates an environment where even sophisticated teams can be vulnerable to infiltration tactics.