North Korean Spies' Elaborate Scheme: A $285 Million Heist from Drift

The sophistication and precision of North Korean government-backed hackers have increased significantly, now accounting for over 76% of crypto losses this year, totaling nearly $600 million. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack. This elaborate scheme, described by TRMLabs, included months of face-to-face meetings between North Korean proxies and Drift employees.

As stated by Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'North Korean proxies sitting across a table from protocol employees over a period of months is, to my knowledge, unprecedented in North Korea's crypto hacking campaign.' This incident highlights the evolution of North Korea's hacking tactics, shifting from remote operations to more intricate, in-person schemes. TRMLabs' recent report reveals that North Korea's primary hacking groups, DPRK and Lazarus, are responsible for 76% of all crypto losses due to hacks and exploits in 2026. Redbord noted, 'What we are watching is not a North Korean campaign that is broader — it is one that is sharper.

North Korea is moving faster and more precisely than ever.' The report also states that North Korea's cumulative crypto theft has exceeded $6 billion since 2017. The findings coincide with the Wasabi Protocol exploit, which utilized a similar approach to the Drift hack on April 19, resulting in the loss of $4.5 million.

In contrast, the $292 million KelpDAO breach exploited a known single-verifier flaw, despite repeated warnings from LayerZero. The hackers behind the Drift exploit converted the stolen funds to USDC, bridged to Ethereum, and swapped them into ETH, which has not been moved since the day of the theft, consistent with the DPRK's patient, multi-year cashout pattern. In contrast, the Lazarus group immediately laundered the KelpDAO proceeds through THORChain and Umbra, following the well-documented TraderTraitor playbook.

The KelpDAO exploit led to DeFi's largest wipeouts, with $13 billion exiting several lending platforms, including Aave, which lost $8.54 billion in deposits over 48 hours, resulting in a nearly $200 million bad-debt crisis.