North Korean Spies' Elaborate Scheme: A $285 Million Heist from Drift

The sophistication and precision of North Korean government-backed hackers have increased, now accounting for over 76% of crypto losses this year, totaling nearly $600 million. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack. This elaborate scheme included months of face-to-face meetings between North Korean proxies and Drift employees.

As described by Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'North Korean proxies sitting across a table from protocol employees over a period of months' is a unique approach in North Korea's crypto hacking campaign. This is a significant departure from the typical remote keyboard operation.

Redbord's comments are part of TRMLabs' new report, which highlights the role of North Korea's primary hacking groups, DPRK and Lazarus, in 76% of all crypto losses due to hacks and exploits in 2026. The report notes that 'what we are watching is not a North Korean campaign that is broader — it is one that is sharper,' with Redbord adding, 'North Korea is moving faster and more precisely than ever.' The cumulative crypto theft attributed to North Korea now exceeds $6 billion since 2017. These findings coincide with the Wasabi Protocol exploit, which used a similar approach to the Drift hack on April 19, resulting in the theft of $4.5 million.

In contrast, the $292 million KelpDAO breach exploited a known single-verifier flaw. The Drift exploit involved converting the stolen funds to USDC, bridging to Ethereum, and swapping into ETH, with no movement of the funds since the day of the theft, consistent with the DPRK's patient, multi-year cashout pattern. In the KelpDAO exploit, Lazarus immediately laundered the proceeds through THORChain and Umbra, using Chinese intermediaries. The Kelp DAO exploit triggered significant withdrawals from lending platforms, with $13 billion exiting several platforms, including Aave, which lost $8.54 billion in deposits over 48 hours, resulting in a nearly $200 million bad-debt crisis.