The sophistication of North Korean government-backed hackers is on the rise, with these groups now accounting for over 76% of crypto losses this year, totaling nearly $600 million. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack spanning months of face-to-face meetings between North Korean proxies and Drift employees. According to Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, this attack is a first in North Korea's crypto hacking campaign, marking a shift from remote operations to more personal, targeted approaches. TRMLabs' latest report highlights the role of North Korea's primary hacking groups, DPRK and Lazarus, in 76% of all crypto losses due to hacks and exploits in 2026.
The report also notes that North Korea's cumulative crypto theft has surpassed $6 billion since 2017. The tactics used in these exploits vary, with the Drift hack involving the conversion of stolen funds to USDC, bridging to Ethereum, and swapping into ETH, which remains untouched since the theft. In contrast, the KelpDAO breach exploited a known flaw and the stolen funds were immediately laundered.
These incidents have significant implications, including DeFi's largest wipeouts, with $13 billion exiting lending platforms and Aave losing $8.54 billion in deposits over 48 hours.