The sophistication of North Korean government-backed hackers is on the rise, with their tactics becoming more refined and precise, resulting in over 76% of crypto losses this year, totaling nearly $600 million. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack spanning several months.
This attack included face-to-face meetings between North Korean proxies and Drift employees, a tactic described as novel in the context of North Korea's crypto hacking operations. According to Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, this approach signifies a shift from traditional remote hacking methods. The report highlights how North Korea's primary hacking groups, DPRK and Lazarus, are accountable for 76% of all crypto losses due to hacks and exploits in 2026.
Redbord notes that North Korea's hacking campaign is becoming sharper and more swift. The cumulative crypto theft attributed to North Korea now exceeds $6 billion since 2017.
The findings from TRMLabs coincide with other recent exploits, such as the Wasabi Protocol hack, which used a similar strategy to the Drift hack on April 19, resulting in the loss of $4.5 million. Another significant breach was the $292 million KelpDAO exploit, which exploited a known vulnerability.
The methods used in these exploits differ, with the Drift hackers converting stolen funds to USDC, bridging to Ethereum, and then swapping to ETH, following a pattern consistent with the DPRK's patient approach to cashing out. In contrast, the Lazarus group immediately laundered the KelpDAO proceeds through THORChain and Umbra, using a well-documented playbook. The KelpDAO exploit had significant repercussions, triggering the largest wipeouts in DeFi history, with $13 billion exiting several lending platforms, including Aave, which lost $8.54 billion in deposits over 48 hours.