The sophistication of North Korean government-backed hackers has increased significantly, now accounting for over 76% of crypto losses this year, totaling nearly $600 million. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack spanning months of face-to-face meetings between North Korean operatives and Drift employees. According to Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, this tactic marks a new level of complexity in North Korea's crypto hacking operations, moving beyond remote attacks. TRMLabs' recent report highlights the significant role of North Korea's primary hacking groups, DPRK and Lazarus, in crypto losses, attributing 76% of all hack and exploit losses in 2026 to these groups.
The report also notes that North Korea's cumulative crypto theft has exceeded $6 billion since 2017, demonstrating a sharper and faster approach. The findings coincide with other exploits, such as the Wasabi Protocol hack, which used a similar strategy to drain $4.5 million. In contrast, the $292 million KelpDAO breach exploited a known vulnerability, showcasing a different playbook. The hackers' tactics, including the conversion of stolen funds to USDC and ETH, align with the DPRK's patient approach to cashing out.
Conversely, Lazarus immediately laundered the KelpDAO proceeds through THORChain and Umbra, utilizing Chinese intermediaries. The KelpDAO exploit led to significant wipeouts in DeFi, with $13 billion exiting lending platforms, resulting in a nearly $200 million bad-debt crisis for Aave, which is being alleviated with $300 million in pledges from industry participants.