A recent six-month infiltration campaign by North Korean hackers at Drift has sent shockwaves through the crypto industry, raising questions about the regime's motivations and tactics. According to security experts, North Korea's reliance on crypto is driven by its need for a revenue stream to keep its economy afloat, given the comprehensive international sanctions it faces. Unlike other state-backed hackers, North Korea's approach is distinct in that it carries out large-scale, traceable heists on public blockchains to gain immediate access to liquid value.
This approach is shaped by the regime's limited export options and lack of a functioning economy, making crypto theft a primary funding mechanism for its nuclear and ballistic missile development. The crypto industry's lack of traditional safeguards, such as compliance checks and settlement delays, makes it a uniquely attractive target for North Korean hackers, who have adopted tactics more commonly associated with intelligence agencies, including months-long relationship building, fabricated identities, and supply chain infiltration.
The Drift campaign is just the latest example of North Korea's refined tactics, which have pushed the crypto industry to re-evaluate its security measures and prioritize stopping attacks before they happen.