The sophistication of North Korean government-backed hackers has increased, now accounting for over 76% of crypto losses, approximately $600 million, in 2026 alone. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack spanning months of meetings between North Korean proxies and Drift employees.
According to Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'North Korean proxies sitting across a table from protocol employees over a period of months, is, to my knowledge, unprecedented in North Korea's crypto hacking campaign.' This incident highlights the evolution of North Korea's hacking tactics, from remote operations to in-person interactions. TRMLabs' report underscores the significant role of North Korea's primary hacking groups, DPRK and Lazarus, in crypto losses, with cumulative theft exceeding $6 billion since 2017.
The report also notes that North Korea's approach is becoming 'sharper,' with faster and more precise actions. Recent exploits, such as the Wasabi Protocol and KelpDAO breaches, demonstrate the varying playbooks employed by these hacking groups, including the use of compromised deployer keys and exploitation of known vulnerabilities. The aftermath of these incidents, including the laundering of stolen funds and the impact on DeFi platforms, further emphasizes the need for heightened security measures in the cryptocurrency space.