Exposed: North Korean Spies' Elaborate Scheme to Drain $285 Million from Drift

The sophistication of North Korean government-backed hackers is on the rise, with their tactics becoming more refined and calculated, resulting in over 76% of crypto losses this year, totaling nearly $600 million. A notable example is the $285 million Drift Protocol exploit, which involved an extraordinary in-person social engineering attack lasting several months, featuring face-to-face meetings between North Korean proxies and Drift employees.

As stated by Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'North Korean proxies engaging in in-person meetings with protocol employees over an extended period is unprecedented in North Korea's crypto hacking efforts.' This is a significant shift from the typical remote hacking operations. The comments were made in conjunction with TRMLabs' latest report, which reveals that North Korea's primary hacking groups, DPRK and Lazarus, are responsible for 76% of all crypto losses due to hacks and exploits in 2026. Redbord noted, 'The North Korean campaign is becoming sharper, with the country moving at a faster and more precise pace than ever.' The report also highlights that North Korea's cumulative crypto theft now surpasses $6 billion, attributed to incidents since 2017.

TRMLabs' findings coincide with the Wasabi Protocol exploit, which used a similar approach to the Drift hack on April 19, where the attackers utilized a compromised deployer key without a timelock or multisig to drain $4.5 million. In contrast, the $292 million KelpDAO breach exploited a known single-verifier flaw that LayerZero had repeatedly warned against.

The tactics employed in the Drift exploit differed significantly from those used in the KelpDAO breach. The hackers converted the Drift proceeds to USDC, bridged to Ethereum, and swapped them into ETH, which has not been moved since the day of the theft, consistent with the DPRK's patient and multi-year cashout pattern. In contrast, Lazarus immediately laundered the KelpDAO proceeds through THORChain and Umbra, primarily handled by Chinese intermediaries using the well-documented TraderTraitor playbook.

The KelpDAO exploit led to DeFi's largest wipeouts, with $13 billion exiting several lending platforms, most notably Aave, which lost $8.54 billion in deposits over 48 hours, resulting in a nearly $200 million bad-debt crisis that industry participants are now helping to alleviate with $300 million in pledges.