A recent six-month infiltration campaign by North Korean hackers at Drift has raised concerns in the crypto industry, prompting questions about why the regime continues to target crypto and what makes its approach different from other state-backed hacking operations. According to security experts, crypto provides North Korea with a vital revenue stream and helps keep its economy afloat. The regime's urgency to obtain hard currency to fund its nuclear and ballistic missile development programs, due to comprehensive international sanctions, explains why its hackers carry out large-scale, traceable heists on public blockchains. Unlike Russia and Iran, which use crypto to evade sanctions, North Korea's hackers are running a state-sponsored heist operation, targeting exchanges, wallet providers, and individual engineers and founders with signing authority or infrastructure access.
The crypto industry's lack of traditional safeguards, such as compliance checks and settlement delays, makes it an attractive hunting ground for North Korean hackers, who have adopted tactics like months-long relationship building and supply chain infiltration. The unique architecture of crypto, which allows for fast and final transactions, fundamentally changes the security calculus, making it essential for the industry to prioritize prevention and stopping attacks before they happen.