The sophistication of North Korean government-backed hackers has increased significantly, now accounting for over 76% of crypto losses, totaling nearly $600 million this year alone. A notable example is the $285 million Drift Protocol exploit, which involved a prolonged and unprecedented in-person social engineering attack. Over several months, North Korean proxies engaged in in-person meetings with Drift employees.
According to Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, this level of in-person interaction is unprecedented in North Korea's crypto hacking campaigns, marking a shift from remote operations. TRMLabs' recent report highlights the significant role of North Korea's primary hacking groups, DPRK and Lazarus, in crypto losses, attributing 76% of all crypto losses to hacks and exploits in 2026 to these groups.
The report also notes that North Korea's cumulative crypto theft exceeds $6 billion since 2017. The findings coincide with other exploits, such as the Wasabi Protocol hack, which used a similar approach to the Drift hack on April 19, resulting in a $4.5 million loss. The $292 million KelpDAO breach, on the other hand, exploited a known single-verifier flaw.
The methods used by hackers in these exploits differ, with the Drift hackers converting proceeds to USDC, bridging to Ethereum, and swapping into ETH without moving the funds since the theft, consistent with the DPRK's patient cashout pattern. In contrast, the Lazarus group immediately laundered the KelpDAO proceeds through THORChain and Umbra, using Chinese intermediaries. The Kelp DAO exploit led to significant losses in DeFi, with $13 billion exiting several lending platforms, including Aave, which lost $8.54 billion in deposits over 48 hours, resulting in a nearly $200 million bad-debt crisis.