The sophistication of North Korean government-backed hackers is on the rise, with these groups now accounting for over 76% of crypto losses this year, totaling nearly $600 million. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack. This elaborate scheme entailed months of face-to-face meetings between North Korean proxies and Drift employees. According to Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, "North Korean proxies sitting across a table from protocol employees over a period of months" is a new level of complexity in North Korea's crypto hacking campaigns.
Redbord's comments are part of TRMLabs' new report, which highlights the significant role of North Korea's two main hacking groups, DPRK and Lazarus, in crypto losses. The report notes that North Korea's cumulative crypto theft has exceeded $6 billion since 2017.
Furthermore, the findings coincide with other recent exploits, such as the Wasabi Protocol hack, which used a similar playbook to the Drift hack. In the $292 million KelpDAO breach, hackers exploited a known single-verifier flaw, demonstrating a different approach from the Drift exploit. The Drift hackers converted the stolen funds to USDC, bridged to Ethereum, and swapped them into ETH, following a patient, multi-year cashout pattern.
In contrast, the Lazarus group immediately laundered the KelpDAO proceeds through THORChain and Umbra, using Chinese intermediaries. The Kelp DAO exploit led to significant losses in DeFi, with $13 billion exiting several lending platforms, including Aave, which lost $8.54 billion in deposits over 48 hours.