The sophistication and precision of North Korean government-backed hackers have reached new heights, accounting for over 76% of crypto losses this year, totaling nearly $600 million. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack that spanned several months. This attack included numerous in-person meetings between North Korean proxies and Drift employees, demonstrating a level of complexity that surpasses traditional remote hacking operations. According to Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'This is no longer just a remote keyboard operation.' TRMLabs' latest report highlights the significant role of North Korea's primary hacking groups, DPRK and Lazarus, in crypto losses, with Redbord noting, 'What we are watching is not a North Korean campaign that is broader — it is one that is sharper.' The report also reveals that North Korea's cumulative crypto theft has exceeded $6 billion since 2017.
Additionally, the findings coincide with other recent exploits, such as the Wasabi Protocol hack, which used a similar playbook to the Drift hack on April 19, resulting in the theft of $4.5 million. The $292 million KelpDAO breach, on the other hand, exploited a known single-verifier flaw.
The hackers behind the Drift exploit converted the stolen funds to USDC, bridged to Ethereum, and swapped them into ETH, following a pattern consistent with the DPRK's patient, multi-year cashout strategy. In contrast, the Lazarus group immediately laundered the KelpDAO proceeds through THORChain and Umbra, utilizing Chinese intermediaries. The Kelp DAO exploit led to DeFi's largest wipeouts, with $13 billion exiting several lending platforms, including Aave, which lost $8.54 billion in deposits over 48 hours, resulting in a nearly $200 million bad-debt crisis.