The sophistication and precision of North Korean government-supported hackers have increased, now accounting for over 76% of crypto losses, approximately $600 million, in 2026 alone. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack lasting several months. This attack included numerous in-person meetings between North Korean proxies and Drift employees. According to Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'North Korean proxies meeting with protocol employees over several months is, to my knowledge, unprecedented in North Korea's crypto hacking campaign.' The report highlights how North Korea's primary hacking groups, DPRK and Lazarus, are responsible for 76% of crypto losses due to hacks and exploits in 2026.
Redbord notes, 'What we are witnessing is not a broader campaign, but a sharper one. North Korea is moving faster and more precisely than ever.' The cumulative crypto theft by North Korea now exceeds $6 billion since 2017.
TRMLabs' findings coincide with the Wasabi Protocol exploit, which used a similar approach to the Drift hack on April 19, where assailants used a compromised deployer key to drain $4.5 million. The $292 million KelpDAO breach exploited a known single-verifier flaw despite repeated warnings from LayerZero. The Drift exploit involved converting proceeds to USDC, bridging to Ethereum, and swapping into ETH, with no movement since the theft, consistent with the DPRK's patient cashout pattern. In contrast, Lazarus immediately laundered the KelpDAO proceeds through THORChain and Umbra, using Chinese intermediaries.
The KelpDAO exploit led to DeFi's largest wipeouts, with $13 billion exiting several lending platforms, resulting in a nearly $200 million bad-debt crisis for Aave.