The sophistication of North Korean government-backed hackers is increasing, with these groups now accounting for over 76% of crypto losses, approximately $600 million, in 2026 alone. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack spanning months of face-to-face meetings between North Korean proxies and Drift employees. As stated by Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'North Korean proxies sitting across a table from protocol employees over a period of months, that is, to my knowledge, unprecedented in North Korea's crypto hacking campaign.' This marks a significant shift from traditional remote operations.
The comments accompany a new report by TRMLabs, highlighting the role of North Korea's primary hacking groups, DPRK and Lazarus, in 76% of all crypto losses due to hacks and exploits in 2026. Redbord noted, 'What we are watching is not a North Korean campaign that is broader — it is one that is sharper.
North Korea is moving faster and more precisely than ever.' The cumulative crypto theft by North Korea now exceeds $6 billion since 2017. The findings by TRMLabs coincide with the Wasabi Protocol exploit, which used a similar approach to the Drift hack on April 19, where assailants utilized a compromised deployer key to drain $4.5 million.
In contrast, the $292 million KelpDAO breach exploited a known single-verifier flaw. The tactics used in the Drift exploit were distinct, with hackers converting proceeds to USDC, bridging to Ethereum, and swapping into ETH, consistent with the DPRK's patient cashout pattern. Conversely, Lazarus immediately laundered the KelpDAO proceeds through THORChain and Umbra, characteristic of the TraderTraitor playbook.
The KelpDAO exploit led to significant wipeouts in DeFi, with $13 billion exiting lending platforms, notably Aave, which lost $8.54 billion in deposits over 48 hours, resulting in a nearly $200 million bad-debt crisis.