The sophistication and precision of North Korean government-backed hackers have increased, now accounting for over 76% or nearly $600 million in cryptocurrency losses this year alone. The $285 million Drift Protocol exploit is a prime example, involving an unprecedented in-person social engineering attack that lasted for months. This attack included numerous in-person meetings between North Korean proxies and Drift employees. As stated by Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'North Korean proxies sitting across a table from protocol employees over a period of months is, to my knowledge, unprecedented in North Korea's crypto hacking campaign.' This incident highlights the evolution of North Korea's hacking campaigns, which are now characterized by sharper and more precise operations.
The cumulative cryptocurrency theft attributed to North Korea now exceeds $6 billion since 2017. Recent exploits, including the Wasabi Protocol and KelpDAO breaches, demonstrate the varying playbooks employed by North Korean hacking groups, such as DPRK and Lazarus.
In the case of the Drift exploit, hackers converted the stolen funds to USDC, bridged to Ethereum, and swapped them into ETH, following a patient, multi-year cashout pattern. In contrast, the KelpDAO proceeds were immediately laundered through THORChain and Umbra, utilizing the TraderTraitor playbook. The Kelp DAO exploit led to significant wipeouts in DeFi, with $13 billion exiting several lending platforms, resulting in a nearly $200 million bad-debt crisis for Aave.