The sophistication of North Korean government-backed hackers is on the rise, with their tactics becoming more refined and precise, resulting in over 76% or approximately $600 million in cryptocurrency losses this year alone. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack spanning several months. This attack consisted of numerous in-person meetings between North Korean proxies and Drift employees. As stated by Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'North Korean proxies engaging in face-to-face interactions with protocol employees over an extended period is, to my knowledge, a first in North Korea's cryptocurrency hacking campaign.' This is a significant departure from the typical remote keyboard operations.
Redbord's remarks accompany TRMLabs' latest report, released on Thursday, which sheds light on how North Korea's primary hacking groups, DPRK and Lazarus, are accountable for 76% of all cryptocurrency losses resulting from hacks and exploits in 2026. The report highlights that 'what we are witnessing is not a broader North Korean campaign, but rather a sharper one,' with Redbord noting, 'North Korea is moving at an unprecedented pace and with greater precision than ever before.' Furthermore, the report states that 'North Korea's cumulative cryptocurrency theft now exceeds $6 billion, attributed to incidents since 2017.' TRMLabs' findings coincide with the Wasabi Protocol exploit, which utilized a similar approach to the Drift hack on April 19, where the attackers exploited a compromised deployer key with no timelock or multisig to drain $4.5 million. In contrast, the $292 million KelpDAO breach exploited a known single-verifier flaw that LayerZero had repeatedly warned against.
The modus operandi differed significantly from the Drift exploit, according to TRMLabs. The hackers converted the Drift proceeds to USDC, bridged to Ethereum, and swapped into ETH, with no movement of the funds since the day of the theft, consistent with the DPRK's patient, multi-year cashout pattern.
In contrast, Lazarus immediately laundered the KelpDAO proceeds through THORChain and Umbra, primarily handled by Chinese intermediaries operating the well-documented TraderTraitor playbook, as explained in the report. The KelpDAO exploit led to DeFi's largest wipeouts, with $13 billion exiting several lending platforms, most notably Aave, which lost $8.54 billion in deposits over 48 hours, resulting in a nearly $200 million bad-debt crisis, which industry participants are now assisting to alleviate with $300 million in pledges.