The sophistication and precision of North Korean government-backed hackers have increased, now accounting for over 76% or approximately $600 million in cryptocurrency losses this year alone. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack lasting several months. This attack included face-to-face meetings between North Korean proxies and Drift employees. As stated by Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'North Korean proxies sitting across a table from protocol employees over a period of months, is to my knowledge, unprecedented in North Korea's crypto hacking campaign.' This statement highlights the evolving nature of these attacks, which are no longer confined to remote operations.
The comments were made in conjunction with TRMLabs' new report, which reveals that North Korea's primary hacking groups, DPRK and Lazarus, are responsible for 76% of all cryptocurrency losses due to hacks and exploits in 2026. Redbord noted, 'What we are witnessing is not a broader North Korean campaign, but rather one that is sharper.' He further added, 'North Korea is moving faster and more precisely than ever.' The report also states that North Korea's total cryptocurrency theft now exceeds $6 billion, attributed to incidents since 2017. These findings coincide with the Wasabi Protocol exploit, which used a similar approach to the Drift hack on April 19, where the attackers utilized a compromised deployer key without a timelock or multisig to drain $4.5 million.
In contrast, the $292 million KelpDAO breach exploited a known single-verifier flaw that LayerZero had repeatedly warned against. The methods used in the Drift exploit differed significantly from those used in the KelpDAO breach, according to TRMLabs. The hackers converted the Drift proceeds to USDC, bridged to Ethereum, and then swapped them into ETH, after which the funds remained stagnant, consistent with the DPRK's patient, multi-year cashout pattern. In contrast, Lazarus immediately laundered the KelpDAO proceeds through THORChain and Umbra, primarily using Chinese intermediaries operating the well-documented TraderTraitor playbook, as explained in the report.
The Kelp DAO exploit led to DeFi's largest wipeouts, with $13 billion exiting several lending platforms, most notably Aave, which lost $8.54 billion in deposits over 48 hours, resulting in a nearly $200 million bad-debt crisis. Industry participants are now helping to alleviate this crisis with $300 million in pledges.