The sophistication of North Korean government-backed hackers is on the rise, with these groups now accounting for over 76% of crypto losses, totaling nearly $600 million this year alone. The $285 million Drift Protocol exploit is a prime example, involving an unprecedented in-person social engineering attack that spanned months of face-to-face meetings between North Korean proxies and Drift employees. As Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, noted, 'North Korean proxies sitting across a table from protocol employees over a period of months is, to my knowledge, unprecedented in North Korea's crypto hacking campaign.' This marks a significant shift from traditional remote hacking operations.
TRMLabs' latest report highlights the role of North Korea's two main hacking groups, DPRK and Lazarus, in 76% of all crypto losses due to hacks and exploits in 2026. According to Redbord, 'What we are watching is not a North Korean campaign that is broader — it is one that is sharper. North Korea is moving faster and more precisely than ever.' The cumulative crypto theft attributed to North Korea now exceeds $6 billion since 2017. The findings coincide with the Wasabi Protocol exploit, which used a similar approach to the Drift hack on April 19, where assailants utilized a compromised deployer key to drain $4.5 million.
In contrast, the $292 million KelpDAO breach exploited a known single-verifier flaw. The Drift exploit involved converting proceeds to USDC, bridging to Ethereum, and swapping into ETH, with no movement of the funds since the theft, consistent with the DPRK's patient cashout pattern.
In the KelpDAO exploit, Lazarus immediately laundered the proceeds through THORChain and Umbra, using Chinese intermediaries. The KelpDAO exploit led to DeFi's largest wipeouts, with $13 billion exiting several lending platforms, including Aave, which lost $8.54 billion in deposits over 48 hours, resulting in a nearly $200 million bad-debt crisis.