The sophistication and precision of North Korean government-backed hackers have increased, now accounting for over 76% or approximately $600 million in cryptocurrency losses this year alone. The $285 million Drift Protocol exploit is a prime example, involving an unprecedented in-person social engineering attack that spanned months of face-to-face meetings between North Korean proxies and Drift employees. As stated by Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, this approach marks a significant departure from the typical remote operations, with North Korean proxies engaging in prolonged, in-person interactions with protocol employees. TRMLabs' recent report highlights the prominent role of North Korea's two main hacking groups, DPRK and Lazarus, in contributing to 76% of all crypto losses due to hacks and exploits in 2026.
The cumulative cryptocurrency theft attributed to North Korea now exceeds $6 billion since 2017, with the country's hacking campaigns becoming increasingly sharper and faster. The report's findings coincide with the Wasabi Protocol exploit, which utilized a similar strategy to the Drift hack on April 19, resulting in the theft of $4.5 million.
In contrast, the $292 million KelpDAO breach exploited a known single-verifier flaw, despite repeated warnings from LayerZero. The Drift exploit involved converting proceeds to USDC, bridging to Ethereum, and swapping into ETH, with no movement of the funds since the day of the theft, consistent with the DPRK's patient, multi-year cashout pattern. In contrast, Lazarus immediately laundered the KelpDAO proceeds through THORChain and Umbra, using Chinese intermediaries and the well-documented TraderTraitor playbook.
The Kelp DAO exploit led to DeFi's largest wipeouts, with $13 billion exiting several lending platforms, including Aave, which lost $8.54 billion in deposits over 48 hours, resulting in a nearly $200 million bad-debt crisis that industry participants are now helping to alleviate with $300 million in pledges.