Sophisticated North Korean Spies Execute $285 Million Heist from Drift in Elaborate Long-Term Scam

The North Korean government's hacking operations have become increasingly complex and precise, now accounting for over 76% of crypto losses this year, totaling nearly $600 million. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack lasting several months. This attack, described by TRMLabs, included numerous in-person meetings between North Korean agents and Drift employees. According to Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, this level of in-person engagement is unparalleled in North Korea's crypto hacking history.

Redbord stated, 'This is no longer just a remote operation, North Korean proxies sat across a table from protocol employees over several months.' TRMLabs' latest report highlights the significant role of North Korea's two primary hacking groups, DPRK and Lazarus, in crypto losses, accounting for 76% of all hack and exploit losses in 2026. The report notes that North Korea's approach has become more targeted and efficient, with Redbord commenting, 'What we are seeing is not a broader campaign, but a sharper one. North Korea is moving faster and more precisely than ever.' The cumulative crypto theft attributed to North Korea now exceeds $6 billion since 2017. The findings coincide with a similar exploit of the Wasabi Protocol, where attackers used a compromised deployer key to drain $4.5 million.

Another notable breach, the $292 million KelpDAO hack, exploited a known single-verifier flaw despite repeated warnings from LayerZero. The methods used in the Drift exploit differed significantly from those used in the KelpDAO breach.

In the Drift case, the hackers converted the stolen funds to USDC, bridged to Ethereum, and then swapped them into ETH, leaving the funds untouched since the day of the theft. This approach is consistent with the DPRK's patient, long-term cashout strategy.

In contrast, the Lazarus group immediately laundered the KelpDAO proceeds through THORChain and Umbra, using a well-documented playbook involving Chinese intermediaries. The KelpDAO exploit triggered significant wipeouts in DeFi, with $13 billion exiting several lending platforms, including Aave, which lost $8.54 billion in deposits over 48 hours and now faces a nearly $200 million bad-debt crisis.