Uncovering the Elaborate Scheme: North Korean Spies' Months-Long In-Person Deception to Steal $285 Million from Drift

The sophistication and precision of North Korean government-backed hackers have increased significantly, now accounting for over 76% or nearly $600 million in cryptocurrency losses this year alone. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack. This elaborate scheme included months of face-to-face meetings between North Korean proxies and Drift employees.

As Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, noted, 'North Korean proxies sitting across a table from protocol employees over a period of months is, to my knowledge, unprecedented in North Korea's crypto hacking campaign.' This incident highlights that North Korea's hacking operations have evolved beyond remote keyboard attacks. TRMLabs' recent report reveals that North Korea's primary hacking groups, DPRK and Lazarus, are responsible for 76% of all cryptocurrency losses due to hacks and exploits in 2026.

Redbord stated, 'What we are watching is not a North Korean campaign that is broader — it is one that is sharper. North Korea is moving faster and more precisely than ever.' The cumulative cryptocurrency theft by North Korea now exceeds $6 billion, attributed to incidents since 2017. The findings by TRMLabs coincide with the Wasabi Protocol exploit, which used a similar approach to the Drift hack on April 19, where the attackers utilized a compromised deployer key to drain $4.5 million.

In contrast, the $292 million KelpDAO breach exploited a known single-verifier flaw. The methods used in the Drift exploit differed significantly from those used in the KelpDAO breach. The hackers converted the stolen Drift funds to USDC, bridged to Ethereum, and swapped them into ETH, which is consistent with the DPRK's patient, multi-year cashout pattern.

In the KelpDAO exploit, the proceeds were immediately laundered through THORChain and Umbra, involving Chinese intermediaries. The KelpDAO exploit led to DeFi's largest wipeouts, with $13 billion exiting several lending platforms, including Aave, which lost $8.54 billion in deposits over 48 hours, resulting in a nearly $200 million bad-debt crisis.