North Korean government-backed hackers have escalated their tactics, now accounting for over 76% of cryptocurrency losses, approximately $600 million, in 2026 alone. The $285 million Drift Protocol exploit is a prime example, involving an unprecedented in-person social engineering attack that spanned months of face-to-face meetings between North Korean agents and Drift employees. According to Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, this level of in-person engagement is a new development in North Korea's crypto hacking campaigns.
Redbord notes, 'This is no longer just a remote operation.' TRMLabs' latest report highlights how North Korea's primary hacking groups, DPRK and Lazarus, are behind 76% of all crypto losses due to hacks and exploits in 2026. The report also reveals that North Korea's cumulative crypto theft has surpassed $6 billion since 2017.
The findings coincide with the Wasabi Protocol exploit, which used a similar strategy to the Drift hack on April 19, resulting in a $4.5 million loss. In contrast, the $292 million KelpDAO breach exploited a known single-verifier flaw. The hackers behind the Drift exploit converted the stolen funds to USDC, bridged to Ethereum, and swapped them into ETH, following a patient, multi-year cashout pattern. In contrast, the Lazarus group immediately laundered the KelpDAO proceeds through THORChain and Umbra, using Chinese intermediaries.
The Kelp DAO exploit led to DeFi's largest wipeouts, with $13 billion exiting several lending platforms, including Aave, which lost $8.54 billion in deposits over 48 hours, resulting in a nearly $200 million bad-debt crisis.