The sophistication and precision of North Korean government-backed hackers are escalating, now accounting for over 76% or approximately $600 million in cryptocurrency losses this year alone. A notable example is the $285 million Drift Protocol exploit, which involved an extraordinary and prolonged in-person social engineering attack.

This operation entailed months of face-to-face meetings between North Korean intermediaries and Drift employees. As described by Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'North Korean intermediaries engaging in in-person meetings with protocol employees over several months is, to my knowledge, unprecedented in North Korea's cryptocurrency hacking campaign.' Redbord emphasized, 'This is no longer just a remote operation.' His comments are part of TRMLabs' recent report, which highlights the significant role of North Korea's primary hacking groups, DPRK and Lazarus, in 76% of all cryptocurrency losses due to hacks and exploits in 2026. The report underscores that 'what we are witnessing is not a broader North Korean campaign, but rather a sharper one,' with Redbord stating, 'North Korea is moving faster and more precisely than ever.' Furthermore, the report notes that North Korea's cumulative cryptocurrency theft has surpassed $6 billion since 2017.

TRMLabs' findings coincide with the Wasabi Protocol exploit, which used a similar strategy to the Drift hack on April 19, where attackers utilized a compromised deployer key without a timelock or multisig to drain $4.5 million. In contrast, the $292 million KelpDAO breach exploited a known single-verifier flaw that LayerZero had repeatedly warned against. The methods used in the Drift exploit differed significantly from those used in the KelpDAO breach. The Drift proceeds were converted to USDC, bridged to Ethereum, and then swapped into ETH, with no movement of the funds since the day of the theft, consistent with the DPRK's patient, multi-year cashout pattern.

In contrast, the Lazarus group immediately laundered the KelpDAO proceeds through THORChain and Umbra, primarily handled by Chinese intermediaries using the well-documented TraderTraitor playbook. The Kelp DAO exploit led to DeFi's largest wipeouts, with $13 billion exiting several lending platforms, most notably Aave, which lost $8.54 billion in deposits over 48 hours, leaving it with a nearly $200 million bad-debt crisis. Industry participants are now helping to alleviate this crisis with $300 million in pledges.