Exposing the Elaborate Scheme: North Korean Spies' Months-Long In-Person Operation to Steal $285 Million from Drift

The sophistication of North Korean government-backed hackers is on the rise, with their tactics becoming more refined and precise, resulting in over 76% or approximately $600 million in cryptocurrency losses this year alone. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack spanning several months.

This operation included face-to-face meetings between North Korean proxies and Drift employees. As described by Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, "North Korean proxies sitting across a table from protocol employees over a period of months, is, to my knowledge, unprecedented in North Korea's crypto hacking campaign. This is no longer just a remote operation." Redbord's comments are part of TRMLabs' recent report, released on Thursday, which highlights the significant role of North Korea's two primary hacking groups, DPRK and Lazarus, in 76% of all cryptocurrency losses due to hacks and exploits in 2026. According to Redbord, "What we are witnessing is not a broader North Korean campaign, but rather one that is more targeted.

North Korea is moving at a faster pace and with greater precision than ever before." The report also notes that "North Korea's cumulative cryptocurrency theft now exceeds $6 billion in attributed incidents since 2017." TRMLabs' findings coincide with the Wasabi Protocol exploit, which used a similar approach to the Drift hack on April 19, where the attackers utilized a compromised deployer key without a timelock or multisig to drain $4.5 million. In contrast, the $292 million KelpDAO breach exploited a known single-verifier flaw that LayerZero had repeatedly warned against. The approach used in the Drift exploit differed significantly from the KelpDAO breach, according to TRMLabs.

The hackers converted the Drift proceeds to USDC, bridged to Ethereum, and swapped them into ETH, without moving them since the day of the theft, consistent with the DPRK's patient, multi-year cashout pattern. In contrast, Lazarus immediately laundered the KelpDAO proceeds through THORChain and Umbra, primarily handled by Chinese intermediaries using the well-documented TraderTraitor playbook, as explained in the report. The KelpDAO exploit led to DeFi's largest wipeouts, with $13 billion exiting several lending platforms, most notably Aave, which lost $8.54 billion in deposits over 48 hours, resulting in a nearly $200 million bad-debt crisis. Industry participants are now helping to alleviate this crisis with $300 million in pledges.