North Korean Spies' Elaborate Scheme: $285 Million Stolen from Drift

The sophistication of North Korean government-backed hackers has increased significantly, now accounting for over 76% of crypto losses, approximately $600 million, in 2026 alone. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack spanning several months. This attack featured prolonged in-person interactions between North Korean proxies and Drift employees.

As stated by Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'North Korean proxies engaging in face-to-face meetings with protocol employees over an extended period is, to my knowledge, a first in North Korea's crypto hacking endeavors.' Redbord's remarks were made in conjunction with TRMLabs' recent report, highlighting the significant role of North Korea's primary hacking groups, DPRK and Lazarus, in crypto losses. The report notes that these groups are responsible for 76% of all crypto losses due to hacks and exploits in 2026. Redbord emphasized, 'The campaign we are observing is not broader, but rather more precise.' He added, 'North Korea is moving at an unprecedented pace and with greater precision.' The cumulative crypto theft attributed to North Korea now exceeds $6 billion since 2017, according to TRM Labs' report.

The findings coincide with the Wasabi Protocol exploit, which utilized a similar strategy to the Drift hack on April 19, where the attackers used a compromised deployer key to drain $4.5 million. In contrast, the $292 million KelpDAO breach exploited a known single-verifier flaw despite repeated warnings from LayerZero. The approach differed significantly from the Drift exploit, as the hackers converted the stolen funds to USDC, bridged to Ethereum, and swapped them into ETH, which remains unmoved since the day of the theft, consistent with the DPRK's patient, multi-year cashout pattern. In contrast, Lazarus immediately laundered the KelpDAO proceeds through THORChain and Umbra, utilizing Chinese intermediaries operating the well-documented TraderTraitor playbook.

The KelpDAO exploit led to DeFi's largest wipeouts, with $13 billion exiting several lending platforms, most notably Aave, which lost $8.54 billion in deposits over 48 hours, resulting in a nearly $200 million bad-debt crisis. Industry participants are now assisting Aave in alleviating this crisis with $300 million in pledges.