The sophistication of North Korean government-backed hackers is increasing, with these groups now accounting for over 76% of crypto losses this year, totaling nearly $600 million. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack lasting several months. This operation included face-to-face meetings between North Korean intermediaries and Drift employees.

As Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, noted, 'North Korean proxies sitting across a table from protocol employees over a period of months is, to my knowledge, unprecedented in North Korea's crypto hacking campaign.' This approach signifies a shift from traditional remote operations. The comments accompany a new TRMLabs report highlighting how North Korea's primary hacking groups, DPRK and Lazarus, are responsible for 76% of all crypto losses due to hacks and exploits in 2026.

Redbord stated, 'What we are watching is not a North Korean campaign that is broader — it is one that is sharper. North Korea is moving faster and more precisely than ever.' The report also reveals that North Korea's cumulative crypto theft now exceeds $6 billion attributed incidents since 2017. These findings coincide with the Wasabi Protocol exploit, which used a similar strategy to the Drift hack on April 19, where assailants utilized a compromised deployer key to drain $4.5 million. In contrast, the $292 million KelpDAO breach exploited a known single-verifier flaw.

The methods used in the Drift exploit differed significantly, with hackers converting proceeds to USDC, bridging to Ethereum, and swapping into ETH without moving the funds since the theft, consistent with the DPRK's patient cashout pattern. Conversely, Lazarus immediately laundered the KelpDAO proceeds through THORChain and Umbra, reflecting a different approach. The KelpDAO exploit led to DeFi's largest wipeouts, with $13 billion exiting several lending platforms, notably Aave, which lost $8.54 billion in deposits over 48 hours and now faces a nearly $200 million bad-debt crisis.