North Korean Spies' Elaborate Scheme: A $285 Million Heist from Drift

The sophistication of North Korean government-backed hackers is increasing, with these groups now accounting for over 76% of crypto losses this year, totaling nearly $600 million. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack.

Over several months, North Korean proxies engaged in face-to-face meetings with Drift employees. As stated by Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'North Korean proxies sitting across a table from protocol employees over a period of months is, to my knowledge, unprecedented in North Korea's crypto hacking campaign.' This incident highlights that North Korea's crypto hacking operations have evolved beyond remote keyboard attacks.

TRMLabs' recent report reveals that North Korea's primary hacking groups, DPRK and Lazarus, are responsible for 76% of all crypto losses due to hacks and exploits in 2026. Redbord noted, 'What we are witnessing is not a broader North Korean campaign, but a sharper one.

North Korea is moving faster and more precisely than ever.' The report also states that North Korea's cumulative crypto theft now exceeds $6 billion since 2017. These findings coincide with the Wasabi Protocol exploit, which used a similar approach to the Drift hack on April 19, where attackers utilized a compromised deployer key to drain $4.5 million. In contrast, the $292 million KelpDAO breach exploited a known single-verifier flaw.

The Drift exploit involved converting the stolen funds to USDC, bridging to Ethereum, and swapping into ETH, with no movement of the funds since the day of the theft, consistent with the DPRK's patient cashout pattern. In contrast, the KelpDAO proceeds were immediately laundered through THORChain and Umbra, following the TraderTraitor playbook.

The Kelp DAO exploit led to DeFi's largest wipeouts, with $13 billion exiting several lending platforms, including Aave, which lost $8.54 billion in deposits over 48 hours, resulting in a nearly $200 million bad-debt crisis.