North Korea's recent six-month infiltration of Drift has sent shockwaves through the crypto industry, still reeling from massive exploits. But a more pressing question has emerged: why does North Korea persist in targeting crypto, and what sets its approach apart from other state-backed hacking operations?
According to security experts, crypto provides the regime with a vital revenue stream, enabling it to stay afloat. "North Korea lacks the luxury of patience," said Dave Schwed, chief operating officer at SVRN. "Under comprehensive international sanctions, they require hard currency to fund their weapons programs. Crypto theft is a primary funding mechanism for their nuclear and ballistic missile development." This urgency explains why North Korean hackers carry out large-scale, traceable heists on public blockchains, rather than using crypto to quietly evade sanctions like other state actors.
The answer lies in the structural differences between North Korea and other sanctioned nations. Unlike Russia and Iran, which have functioning economies and use crypto as a payment rail, North Korea has almost nothing to sell, with its exports largely sanctioned.
"Their exports are almost entirely sanctioned. They don't have a functioning economy that needs a payment rail. They need direct revenue," Schwed explained.
"Crypto theft gives them immediate access to liquid value, globally, without needing a counterparty willing to do business with them." This distinction - crypto as infrastructure versus crypto as a target - separates North Korea from Russia and Iran. While Russia and Iran use crypto to work around sanctions and fund proxy networks, North Korea operates a state-sponsored heist operation, targeting exchanges, wallet providers, DeFi protocols, and individuals with signing authority or infrastructure access.
"Their targets are whoever holds the keys or access to the infrastructure that holds the keys," said Alexander Urbelis, chief information security officer at ENS Labs. The tactics employed by North Korean operatives are more commonly associated with intelligence agencies than criminal hackers, involving months-long relationship building, fabricated identities, and supply chain infiltration. The Drift campaign is a recent example.
"You're not defending against a phishing email from a random scammer," Urbelis said. "You're defending against someone who spent six months building a relationship specifically to compromise one person who has the access you need to protect." Crypto's architecture makes it an attractive hunting ground, with none of the traditional finance safeguards, such as compliance checks and settlement delays, existing at the protocol level.
"Once a transaction is signed and confirmed, it's final," Urbelis said. The Bybit exploit earlier last year moved $1.5 billion in roughly 30 minutes, a pace and scale that would be nearly impossible in the traditional banking system.
This finality changes the security calculus, making it essential to stop attacks before they happen. While banks operate under decades of regulatory guidance and audit requirements, many crypto projects are still improvising, often prioritizing speed and innovation over governance and controls. This gap creates an environment where even sophisticated teams can be vulnerable, particularly to North Korea's long-term infiltration tactics.
"This is the hardest operational security problem in crypto right now," Urbelis said. "I don't think the industry has solved it."