The sophistication and precision of North Korean government-backed hackers have increased, now accounting for over 76% or approximately $600 million in cryptocurrency losses this year alone. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack. This attack included months of face-to-face meetings between North Korean proxies and Drift employees. As Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, noted, 'North Korean proxies sitting across a table from protocol employees over a period of months is, to my knowledge, unprecedented in North Korea's crypto hacking campaign.' This comments accompanied TRMLabs' new report, highlighting how North Korea's primary hacking groups, DPRK and Lazarus, are responsible for 76% of all cryptocurrency losses due to hacks and exploits in 2026.
The report also states that 'North Korea's cumulative crypto theft now exceeds $6 billion attributed incidents since 2017.' Furthermore, TRMLabs' findings coincide with the Wasabi Protocol exploit, which used a similar approach to the Drift hack on April 19, where attackers used a compromised deployer key to drain $4.5 million. In contrast to the Drift exploit, the $292 million KelpDAO breach exploited a known single-verifier flaw.
The playbook for the Drift exploit involved converting the proceeds to USDC, bridging to Ethereum, and swapping into ETH, with no movement of the funds since the day of the theft, consistent with the DPRK's patient, multi-year cashout pattern.