Exposing the Elaborate Scheme: North Korean Spies' Months-Long In-Person Effort to Drain $285 Million from Drift

North Korean government-backed hackers have become increasingly sophisticated, now accounting for over 76% or approximately $600 million in cryptocurrency losses this year alone. The $285 million Drift Protocol exploit is a prime example, involving an unprecedented in-person social engineering attack that lasted for months. This attack included numerous in-person meetings between North Korean proxies and Drift employees. As Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, noted, 'North Korean proxies sitting across a table from protocol employees over a period of months is, to my knowledge, unprecedented in North Korea's crypto hacking campaign.' This highlights a shift from remote keyboard operations to more complex, in-person attacks.

TRMLabs' recent report reveals that North Korea's two primary hacking groups, DPRK and Lazarus, are responsible for 76% of all cryptocurrency losses due to hacks and exploits in 2026. According to Redbord, 'What we are witnessing is not a broader North Korean campaign, but a sharper one. North Korea is moving faster and more precisely than ever.' The report also states that North Korea's cumulative cryptocurrency theft now exceeds $6 billion, attributed to incidents since 2017. These findings coincide with the Wasabi Protocol exploit, which used a similar approach to the Drift hack on April 19, where attackers utilized a compromised deployer key to drain $4.5 million.

In contrast, the $292 million KelpDAO breach exploited a known single-verifier flaw that LayerZero had repeatedly warned against. The methods used by the hackers differed significantly from the Drift exploit, with the Drift proceeds being converted to USDC, bridged to Ethereum, and swapped into ETH, remaining untouched since the day of the theft. This is consistent with the DPRK's patient, multi-year cashout pattern. In contrast, Lazarus immediately laundered the KelpDAO proceeds through THORChain and Umbra, using Chinese intermediaries.

The Kelp DAO exploit led to DeFi's largest wipeouts, with $13 billion exiting several lending platforms, including Aave, which lost $8.54 billion in deposits over 48 hours, resulting in a nearly $200 million bad-debt crisis.