Exposing the Extensive Deception: North Korean Spies' Months-Long Scheme to Drain $285 Million from Drift

Government-backed North Korean hackers have demonstrated increased sophistication and precision, accounting for over 76% or approximately $600 million in cryptocurrency losses this year alone. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack spanning several months.

This attack included numerous in-person meetings between North Korean proxies and Drift employees. As stated by Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'North Korean proxies engaging in face-to-face meetings with protocol employees over an extended period is, to my knowledge, a first in North Korea's crypto hacking campaign.' This marks a significant shift from traditional remote keyboard operations. The comments accompany TRMLabs' recent report, which highlights the role of North Korea's primary hacking groups, DPRK and Lazarus, in 76% of all cryptocurrency losses due to hacks and exploits in 2026.

Redbord noted, 'What we are witnessing is not a broader North Korean campaign, but rather a more precise one.' The report also reveals that North Korea's cumulative cryptocurrency theft exceeds $6 billion since 2017. The findings coincide with the Wasabi Protocol exploit, which utilized a similar strategy to the Drift hack on April 19, where the attackers used a compromised deployer key to drain $4.5 million.

In contrast, the $292 million KelpDAO breach exploited a known single-verifier flaw despite repeated warnings from LayerZero. The tactics employed in the Drift exploit differed significantly, with hackers converting the stolen funds to USDC, bridging to Ethereum, and swapping them into ETH, which remains unmoved since the day of the theft, consistent with the DPRK's patient cashout pattern. In the KelpDAO exploit, Lazarus immediately laundered the proceeds through THORChain and Umbra, involving Chinese intermediaries and the TraderTraitor playbook. The KelpDAO exploit led to DeFi's largest wipeouts, with $13 billion exiting several lending platforms, most notably Aave, which lost $8.54 billion in deposits over 48 hours, resulting in a nearly $200 million bad-debt crisis that industry participants are helping to alleviate with $300 million in pledges.