The sophistication of North Korean government-backed hackers is increasing, with these groups now accounting for over 76% of crypto losses, totaling nearly $600 million in 2026 alone. The $285 million Drift Protocol exploit is a prime example, involving an unprecedented in-person social engineering attack that spanned months of face-to-face meetings between North Korean proxies and Drift employees. This level of in-person deception is a new development in North Korea's crypto hacking campaign, moving beyond remote operations. A recent report by TRMLabs highlights the significant role of North Korea's main hacking groups, DPRK and Lazarus, in crypto losses, with the cumulative theft exceeding $6 billion since 2017.
The report also notes that North Korea's hacking efforts are becoming more targeted and efficient, with the ability to move quickly and precisely. The Drift exploit, as well as other recent hacks such as the Wasabi Protocol and KelpDAO breaches, demonstrate the evolving strategies of these hacking groups, including the use of compromised deployer keys, exploitation of known vulnerabilities, and complex laundering techniques.