The sophistication and precision of North Korean government-backed hackers have increased, now accounting for over 76% of crypto losses, totaling nearly $600 million this year alone. The $285 million Drift Protocol exploit is a prime example, involving an unprecedented in-person social engineering attack that spanned months of face-to-face meetings between North Korean proxies and Drift employees. According to Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, this tactic is a new development in North Korea's crypto hacking campaign, marking a shift from remote operations.
TRMLabs' report highlights the role of North Korea's two primary hacking groups, DPRK and Lazarus, in 76% of all crypto losses due to hacks and exploits in 2026. The report also notes that North Korea's cumulative crypto theft has exceeded $6 billion since 2017, with the hacking groups becoming faster and more precise in their operations.
The findings coincide with other recent exploits, including the Wasabi Protocol and KelpDAO breaches, which demonstrate the varying tactics employed by these hacking groups.