North Korean government-sponsored hackers have become increasingly sophisticated, now accounting for over 76% of crypto losses this year, totaling nearly $600 million. The recent $285 million Drift Protocol exploit is a prime example, involving an unprecedented in-person social engineering attack that spanned months of face-to-face meetings between North Korean intermediaries and Drift employees. As noted by Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'North Korean proxies engaging in in-person meetings with protocol employees over several months is, to my knowledge, a first in North Korea's crypto hacking campaign.' This approach marks a significant shift from traditional remote hacking operations. TRMLabs' latest report highlights the key role of North Korea's two primary hacking groups, DPRK and Lazarus, in 76% of all crypto losses due to hacks and exploits in 2026.
Redbord emphasized that 'what we are witnessing is not a broader campaign, but a sharper one,' with North Korea moving 'faster and more precisely than ever.' The cumulative crypto theft attributed to North Korea now exceeds $6 billion since 2017. The findings coincide with the Wasabi Protocol exploit, which used a similar strategy to the Drift hack on April 19, where attackers utilized a compromised deployer key to drain $4.5 million.
In contrast, the $292 million KelpDAO breach exploited a known single-verifier flaw. The Drift exploit involved converting the stolen funds to USDC, bridging to Ethereum, and swapping into ETH, with no movement of the funds since the day of the theft, consistent with the DPRK's patient, multi-year cashout pattern. In contrast, Lazarus immediately laundered the KelpDAO proceeds through THORChain and Umbra, using Chinese intermediaries.
The Kelp DAO exploit triggered significant withdrawals from DeFi lending platforms, with $13 billion exiting several platforms, including Aave, which lost $8.54 billion in deposits over 48 hours, resulting in a nearly $200 million bad-debt crisis.