The sophistication and precision of North Korean government-backed hackers have increased, now accounting for over 76% of crypto losses this year, totaling nearly $600 million. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack.
This attack included months of face-to-face meetings between North Korean proxies and Drift employees. According to Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, "North Korean proxies sitting across a table from protocol employees over a period of months...
This is no longer just a remote keyboard operation." TRMLabs' new report highlights how North Korea's main hacking groups are responsible for 76% of all crypto losses to hacks and exploits in 2026. The report also notes that North Korea's cumulative crypto theft now exceeds $6 billion since 2017.
The findings coincide with other recent exploits, such as the Wasabi Protocol and KelpDAO breaches, which demonstrate the varying playbooks used by different hacking groups.