A recent six-month infiltration campaign by North Korean hackers at Drift has sent shockwaves through the crypto industry, prompting questions about the regime's motivations and tactics. According to security experts, North Korea's reliance on crypto is driven by its isolated economy and need for direct revenue.
Unlike other state-backed hackers, North Korea's operatives carry out large-scale, traceable heists on public blockchains, seeking immediate access to liquid value. This approach sets them apart from other state-sponsored hacking operations, such as those conducted by Russia and Iran, which use crypto as a means to work around sanctions or fund proxy networks.
North Korea's singular focus on crypto has led them to adopt sophisticated tactics, including months-long relationship building, fabricated identities, and supply chain infiltration. The crypto industry's unique architecture, lacking traditional finance's safeguards, makes it an attractive target for North Korean hackers. The finality of crypto transactions means that stopping an attack before it happens is essentially the only option, and the industry's improvisational approach to governance and controls creates an environment where even sophisticated teams can be vulnerable to long-term infiltration tactics.