A recent six-month infiltration campaign by North Korean hackers at Drift has raised concerns in the crypto industry, prompting questions about the regime's motivations and tactics. According to experts, North Korea relies on crypto to generate revenue and stay afloat due to comprehensive international sanctions.
The regime's approach differs from other state-backed hacking operations, as it carries out large-scale, traceable heists on public blockchains to obtain immediate access to liquid value. This distinction sets North Korea apart from countries like Russia and Iran, which use crypto as a means to work around sanctions or fund proxy networks. North Korean operatives have adopted sophisticated tactics, including months-long relationship building, fabricated identities, and supply chain infiltration, to target exchanges, wallet providers, DeFi protocols, and individual engineers and founders. The crypto industry's lack of traditional financial safeguards and regulatory guidance creates an environment vulnerable to such attacks, making it essential for the industry to rethink its security measures.