The sophistication and precision of North Korean government-backed hackers have increased, now accounting for over 76% or nearly $600 million in cryptocurrency losses this year alone. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack spanning months of meetings between North Korean proxies and Drift employees.
As described by Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'North Korean proxies sitting across a table from protocol employees over a period of months' signifies a shift from remote operations to more personal, targeted approaches. This tactic is part of a broader trend, as highlighted in TRMLabs' new report, where North Korea's primary hacking groups, DPRK and Lazarus, are attributed to 76% of all cryptocurrency losses due to hacks and exploits in 2026. Redbord emphasizes, 'What we are watching is not a North Korean campaign that is broader — it is one that is sharper,' indicating North Korea's increased speed and precision in their hacking efforts.
The cumulative crypto theft by North Korea now exceeds $6 billion since 2017. The report's findings coincide with other exploits, such as the Wasabi Protocol and the $292 million KelpDAO breach, which, despite using different playbooks, demonstrate the evolving nature of these hacking campaigns. Each exploit reveals distinct strategies, from the conversion and bridging of stolen funds to the use of various intermediaries for laundering, reflecting the patient and multi-year cashout patterns of these hacking groups.