The sophistication of North Korean government-backed hackers is on the rise, with these groups now accounting for over 76% of crypto losses, totaling nearly $600 million in 2026 alone. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack spanning several months. This attack, described by TRMLabs, featured numerous in-person meetings between North Korean proxies and Drift employees. As Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, noted, 'North Korean proxies sitting across a table from protocol employees over a period of months is, to my knowledge, unprecedented in North Korea's crypto hacking campaign.' This statement highlights the evolving nature of North Korea's hacking operations, which are becoming more precise and sophisticated.
TRMLabs' recent report reveals that North Korea's primary hacking groups, DPRK and Lazarus, are responsible for 76% of all crypto losses due to hacks and exploits in 2026. The report also mentions that North Korea's cumulative crypto theft has surpassed $6 billion since 2017. Furthermore, the findings coincide with the Wasabi Protocol exploit, which used a similar approach to the Drift hack, resulting in the theft of $4.5 million. In contrast, the $292 million KelpDAO breach exploited a known single-verifier flaw.
The methods used by the hackers differed significantly from the Drift exploit, with the Drift proceeds being converted to USDC, bridged to Ethereum, and swapped into ETH, consistent with the DPRK's patient cashout pattern. In the KelpDAO exploit, the proceeds were immediately laundered through THORChain and Umbra, following the TraderTraitor playbook. The KelpDAO exploit led to DeFi's largest wipeouts, with $13 billion exiting several lending platforms, including Aave, which lost $8.54 billion in deposits over 48 hours, resulting in a nearly $200 million bad-debt crisis.