A six-month infiltration campaign by North Korean hackers at Drift has raised questions about the regime's motivations and tactics in the crypto industry. According to security experts, North Korea's urgent need for hard currency to fund its nuclear and ballistic missile programs drives its focus on crypto heists. Unlike other state-backed hackers, North Korea's operatives carry out large-scale, traceable heists on public blockchains due to the regime's lack of a functioning economy and need for direct revenue.
This approach has led to the adoption of tactics more commonly associated with intelligence agencies, including months-long relationship building, fabricated identities, and supply chain infiltration. The crypto industry's unique architecture and lack of safeguards make it an attractive target for North Korean hackers, who can exploit the finality of crypto transactions to their advantage.
Experts warn that stopping these attacks before they happen is the only viable option, and that the industry has yet to solve the operational security problem posed by sophisticated fake identities and third-party intermediaries.