The sophistication of North Korean government-backed hackers is on the rise, with these groups now accounting for over 76% of crypto losses this year, totaling nearly $600 million. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented long-term in-person social engineering attack. This elaborate scheme included months of face-to-face meetings between North Korean proxies and Drift employees.
According to Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'North Korean proxies sitting across a table from protocol employees over a period of months' is a unique approach in North Korea's crypto hacking campaign. Redbord emphasized that this is no longer just a remote operation. TRMLabs' recent report highlights how North Korea's primary hacking groups, DPRK and Lazarus, are responsible for 76% of all crypto losses due to hacks and exploits in 2026. The report notes that 'North Korea is moving faster and more precisely than ever,' with cumulative crypto theft exceeding $6 billion since 2017.
The findings coincide with other exploits, such as the Wasabi Protocol hack, where attackers used a similar approach to drain $4.5 million. In contrast to the Drift exploit, the $292 million KelpDAO breach exploited a known vulnerability.
The hackers' playbook varied significantly, with the Drift proceeds being converted to USDC, bridged to Ethereum, and swapped into ETH, remaining untouched since the theft. This pattern is consistent with the DPRK's patient approach to cashing out. In the KelpDAO exploit, Lazarus immediately laundered the proceeds through THORChain and Umbra, involving Chinese intermediaries.
The Kelp DAO exploit led to significant losses in DeFi, with $13 billion exiting lending platforms, including Aave, which lost $8.54 billion in deposits over 48 hours.