Uncovering the Elaborate Scheme: North Korean Spies' Months-Long In-Person Operation to Siphon $285 Million from Drift

The sophistication and precision of North Korean government-backed hackers are on the rise, now accounting for over 76% or nearly $600 million in cryptocurrency losses this year alone. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack that included months of face-to-face meetings between North Korean proxies and Drift employees. As described by Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, this attack is distinctive due to its in-person nature, marking a departure from the typical remote operations.

Redbord stated, 'North Korean proxies sitting across a table from protocol employees over a period of months, that is, to my knowledge, unprecedented in North Korea's crypto hacking campaign.' This development comes as TRMLabs releases a new report highlighting the significant role of North Korea's primary hacking groups, DPRK and Lazarus, in crypto losses due to hacks and exploits in 2026, which account for 76% of the total. The report emphasizes that North Korea's approach is becoming sharper and more precise, with Redbord noting, 'What we are watching is not a North Korean campaign that is broader — it is one that is sharper.

North Korea is moving faster and more precisely than ever.' Furthermore, the cumulative cryptocurrency theft attributed to North Korea now exceeds $6 billion since 2017. These findings are concurrent with the Wasabi Protocol exploit, which utilized a similar strategy to the Drift hack on April 19, where the attackers used a compromised deployer key to drain $4.5 million. In contrast, the $292 million KelpDAO breach exploited a known single-verifier flaw despite repeated warnings from LayerZero.

The methods used in these exploits differ significantly, with the Drift hackers converting the stolen funds to USDC, bridging to Ethereum, and swapping into ETH without moving them since the theft, consistent with the DPRK's patient cashout pattern. Conversely, the Lazarus group immediately laundered the KelpDAO proceeds through THORChain and Umbra, predominantly using Chinese intermediaries. The KelpDAO exploit led to DeFi's largest wipeouts, with $13 billion exiting several lending platforms, including Aave, which lost $8.54 billion in deposits over 48 hours and now faces a nearly $200 million bad-debt crisis that industry participants are helping to alleviate with $300 million in pledges.