North Korean Spies' Elaborate Scheme: A $285 Million Heist from Drift

The sophistication of North Korean government-backed hackers is on the rise, with their tactics becoming more refined and targeted. This year alone, they have accounted for over 76% of crypto losses, totaling nearly $600 million. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack. Over several months, North Korean proxies engaged in face-to-face meetings with Drift employees.

As Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, noted, 'North Korean proxies sitting across a table from protocol employees over a period of months is, to my knowledge, unprecedented in North Korea's crypto hacking campaign.' This marks a significant shift from traditional remote hacking operations. The comments accompanied TRMLabs' new report, which highlights the role of North Korea's primary hacking groups, DPRK and Lazarus, in 76% of all crypto losses to hacks and exploits in 2026.

Redbord stated, 'What we are watching is not a North Korean campaign that is broader — it is one that is sharper. North Korea is moving faster and more precisely than ever.' The report also revealed that North Korea's cumulative crypto theft has surpassed $6 billion since 2017. These findings coincide with the Wasabi Protocol exploit, which used a similar approach to the Drift hack on April 19, where assailants utilized a compromised deployer key to drain $4.5 million. In contrast, the $292 million KelpDAO breach exploited a known single-verifier flaw.

The hackers behind the Drift exploit converted the stolen funds to USDC, bridged to Ethereum, and swapped them into ETH, which has not been moved since the day of the theft, consistent with the DPRK's patient cashout pattern. In contrast, the Lazarus group immediately laundered their KelpDAO proceeds through THORChain and Umbra, using Chinese intermediaries. The Kelp DAO exploit led to DeFi's largest wipeouts, with $13 billion exiting several lending platforms, including Aave, which lost $8.54 billion in deposits over 48 hours, resulting in a nearly $200 million bad-debt crisis.