The sophistication of North Korean government-backed hackers is on the rise, with their methods becoming more refined and precise, resulting in over 76% of crypto losses this year, totaling nearly $600 million. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack that spanned several months of face-to-face meetings between North Korean proxies and Drift employees.
As described by Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'North Korean proxies sitting across a table from protocol employees over a period of months' is a unique approach in North Korea's crypto hacking campaign. Redbord emphasized that this is no longer a remote operation, but rather a more personal and targeted approach. TRMLabs' recent report highlights how North Korea's primary hacking groups, DPRK and Lazarus, are accountable for 76% of all crypto losses due to hacks and exploits in 2026.
The report also notes that North Korea's cumulative crypto theft has exceeded $6 billion since 2017. Furthermore, the report's findings coincide with the Wasabi Protocol exploit, which used a similar approach to the Drift hack on April 19, resulting in a $4.5 million loss. Additionally, the $292 million KelpDAO breach exploited a known single-verifier flaw, despite repeated warnings from LayerZero. The methods used in these exploits differ significantly, with the Drift hackers converting proceeds to USDC, bridging to Ethereum, and swapping into ETH, whereas the Lazarus group immediately laundered their KelpDAO proceeds through THORChain and Umbra.
The Kelp DAO exploit had a significant impact on DeFi, triggering a $13 billion exit from several lending platforms, including Aave, which lost $8.54 billion in deposits over 48 hours, resulting in a nearly $200 million bad-debt crisis.