The sophistication and precision of North Korean government-backed hackers have increased, now accounting for over 76% or approximately $600 million in cryptocurrency losses this year. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack lasting several months.
This operation included numerous face-to-face meetings between North Korean intermediaries and Drift employees. As stated by Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'North Korean proxies engaging in in-person meetings with protocol employees over an extended period is, to my knowledge, a first in North Korea's cryptocurrency hacking campaign.' TRMLabs' recent report highlights that North Korea's primary hacking groups, DPRK and Lazarus, are responsible for 76% of all cryptocurrency losses due to hacks and exploits in 2026. The report also notes that 'North Korea's cumulative cryptocurrency theft now exceeds $6 billion attributed incidents since 2017.' Additionally, TRMLabs' findings coincide with the Wasabi Protocol exploit, which used a similar strategy to the Drift hack on April 19, resulting in the theft of $4.5 million.
In contrast, the $292 million KelpDAO breach exploited a known single-verifier flaw. The methods used in the Drift exploit differed significantly from those used in the KelpDAO breach. The hackers behind the Drift exploit converted the stolen funds to USDC, bridged to Ethereum, and swapped them into ETH, leaving them untouched since the day of the theft, consistent with the DPRK's patient, long-term cash-out pattern.