The sophistication of North Korean government-backed hackers is on the rise, with these groups now accounting for over 76% of crypto losses this year, totaling nearly $600 million. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack spanning months of face-to-face meetings between North Korean intermediaries and Drift employees. As described by Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, "North Korean proxies sitting across a table from protocol employees over a period of months...
This is no longer just a remote keyboard operation." TRMLabs' recent report highlights the significant role of North Korea's primary hacking groups, DPRK and Lazarus, in crypto losses due to hacks and exploits in 2026, which account for 76% of all such losses. Redbord notes, "What we are watching is not a North Korean campaign that is broader — it is one that is sharper... North Korea is moving faster and more precisely than ever." The cumulative crypto theft attributed to North Korea now exceeds $6 billion since 2017, according to TRM Labs' report.
The findings coincide with the Wasabi Protocol exploit, where attackers used a similar strategy to the Drift hack on April 19, utilizing a compromised deployer key to drain $4.5 million. In contrast to the Drift exploit, the $292 million KelpDAO breach exploited a known single-verifier flaw despite repeated warnings from LayerZero. The Drift hackers converted the stolen funds to USDC, bridged to Ethereum, and swapped them into ETH, following the DPRK's characteristic patient, multi-year cashout pattern. Conversely, Lazarus immediately laundered the KelpDAO proceeds through THORChain and Umbra, consistent with the well-documented TraderTraitor playbook.
The KelpDAO exploit led to DeFi's largest wipeouts, with $13 billion exiting several lending platforms, including Aave, which lost $8.54 billion in deposits over 48 hours and now faces a nearly $200 million bad-debt crisis.