The sophistication of North Korean government-backed hackers has increased significantly, now accounting for over 76% of crypto losses this year, totaling nearly $600 million. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack spanning months. This attack included numerous in-person meetings between North Korean proxies and Drift employees.
As stated by Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'North Korean proxies sitting across a table from protocol employees over a period of months is, to my knowledge, unprecedented in North Korea's crypto hacking campaign.' This method of operation is a departure from the typical remote keyboard-based attacks. The comments from Redbord accompany a new report by TRMLabs, highlighting that North Korea's primary hacking groups, DPRK and Lazarus, are responsible for 76% of all crypto losses due to hacks and exploits in 2026. Redbord noted, 'What we are watching is not a North Korean campaign that is broader — it is one that is sharper.
North Korea is moving faster and more precisely than ever.' The report also reveals that North Korea's cumulative crypto theft now exceeds $6 billion attributed incidents since 2017. These findings coincide with the Wasabi Protocol exploit, which used a similar approach to the Drift hack on April 19, where assailants used a compromised deployer key to drain $4.5 million.
In contrast, the $292 million KelpDAO breach exploited a known single-verifier flaw. The methods used in the Drift exploit differed significantly from those used in the KelpDAO breach. The hackers converted the Drift proceeds to USDC, bridged to Ethereum, swapped into ETH, and have not moved them since the day of the theft, consistent with the DPRK's patient, multi-year cashout pattern.
In the KelpDAO exploit, Lazarus immediately laundered the proceeds through THORChain and Umbra, which is handled almost entirely by Chinese intermediaries. The Kelp DAO exploit led to DeFi's largest wipeouts, with $13 billion exiting several lending platforms, most notably Aave, which lost $8.54 billion in deposits over 48 hours, resulting in a nearly $200 million bad-debt crisis.