North Korean government-backed hackers have become increasingly sophisticated, now accounting for over 76% of crypto losses this year, totaling nearly $600 million. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack.
Over several months, North Korean proxies engaged in face-to-face meetings with Drift employees. According to Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'North Korean proxies sitting across a table from protocol employees over a period of months is, to my knowledge, unprecedented in North Korea's crypto hacking campaign.' This approach marks a significant shift from traditional remote operations. TRMLabs' recent report highlights how North Korea's primary hacking groups, DPRK and Lazarus, are responsible for 76% of all crypto losses due to hacks and exploits in 2026. Redbord notes, 'What we are witnessing is not a broader North Korean campaign, but a sharper one.
North Korea is moving faster and more precisely than ever.' The cumulative crypto theft attributed to North Korea now exceeds $6 billion since 2017. The findings coincide with the Wasabi Protocol exploit, which used a similar playbook to the Drift hack on April 19, resulting in a $4.5 million loss. In contrast, the $292 million KelpDAO breach exploited a known single-verifier flaw.
The hackers behind the Drift exploit converted the stolen funds to USDC, bridged to Ethereum, and swapped them into ETH, following the DPRK's patient, multi-year cashout pattern. In contrast, the Lazarus group immediately laundered the KelpDAO proceeds through THORChain and Umbra, using Chinese intermediaries.
The KelpDAO exploit led to DeFi's largest wipeouts, with $13 billion exiting several lending platforms, including Aave, which lost $8.54 billion in deposits over 48 hours.