The sophistication and precision of North Korean government-backed hackers have increased, now accounting for over 76% of crypto losses this year, totaling nearly $600 million. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack.
This elaborate scheme included months of face-to-face meetings between North Korean operatives and Drift employees. According to Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'North Korean proxies sitting across a table from protocol employees over a period of months is, to my knowledge, unprecedented in North Korea's crypto hacking campaign.' This incident highlights the evolving nature of North Korea's hacking campaigns, which are becoming more targeted and complex. TRMLabs' report sheds light on how North Korea's primary hacking groups, DPRK and Lazarus, are responsible for 76% of all crypto losses to hacks and exploits in 2026.
The report also notes that North Korea's cumulative crypto theft has exceeded $6 billion since 2017. The findings coincide with other recent exploits, including the Wasabi Protocol and KelpDAO breaches, which demonstrate the varying tactics employed by these hacking groups. The Drift exploit involved a unique playbook, where the attackers converted the stolen funds to USDC, bridged to Ethereum, and swapped into ETH, without moving them since the day of the theft.
In contrast, the KelpDAO exploit involved immediate laundering through THORChain and Umbra, showcasing the different strategies employed by these groups.