The sophistication and precision of North Korean government-backed hackers have increased, now accounting for over 76% or approximately $600 million in cryptocurrency losses this year alone. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack lasting several months. This operation included numerous face-to-face meetings between North Korean proxies and Drift employees.
According to Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'North Korean proxies sitting across a table from protocol employees over a period of months is, to my knowledge, unprecedented in North Korea's crypto hacking campaign.' This incident highlights the evolution of North Korea's hacking tactics, shifting from remote operations to more intricate, in-person schemes. TRMLabs' recent report, released on Thursday, sheds light on how North Korea's primary hacking groups, DPRK and Lazarus, are responsible for 76% of all cryptocurrency losses due to hacks and exploits in 2026. The report also notes that 'North Korea is moving faster and more precisely than ever,' with their cumulative crypto theft exceeding $6 billion since 2017.
Furthermore, the findings coincide with the Wasabi Protocol exploit, which used a similar approach to the Drift hack, resulting in the loss of $4.5 million. The $292 million KelpDAO breach, on the other hand, exploited a known single-verifier flaw, despite repeated warnings from LayerZero. The methods used in these exploits differ significantly, with the Drift hackers converting proceeds to USDC, bridging to Ethereum, and swapping into ETH, whereas the Lazarus group immediately laundered their KelpDAO proceeds through THORChain and Umbra.
The KelpDAO exploit triggered a massive exodus of $13 billion from several lending platforms, including Aave, which lost $8.54 billion in deposits over 48 hours, resulting in a nearly $200 million bad-debt crisis.