The sophistication of North Korean government-backed hackers is on the rise, with these groups now accounting for over 76% of crypto losses this year, totaling nearly $600 million. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack spanning months. This attack included repeated in-person meetings between North Korean proxies and Drift employees, marking a significant shift from traditional remote hacking operations.
According to Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'This is no longer just a remote keyboard operation.' TRMLabs' recent report highlights the role of North Korea's primary hacking groups, DPRK and Lazarus, in 76% of crypto losses due to hacks and exploits in 2026. Redbord notes, 'What we are watching is not a North Korean campaign that is broader — it is one that is sharper.
North Korea is moving faster and more precisely than ever.' The report also reveals that North Korea's cumulative crypto theft has exceeded $6 billion since 2017. Additionally, TRMLabs' findings coincide with the Wasabi Protocol exploit, which used a similar approach to the Drift hack on April 19, resulting in the loss of $4.5 million. The $292 million KelpDAO breach, on the other hand, exploited a known single-verifier flaw, despite repeated warnings from LayerZero. The methods used by the hackers differed significantly from the Drift exploit, with the Drift proceeds being converted to USDC, bridged to Ethereum, and swapped into ETH, consistent with the DPRK's patient, multi-year cashout pattern.
In contrast, the KelpDAO proceeds were immediately laundered through THORChain and Umbra, using Chinese intermediaries. The Kelp DAO exploit led to DeFi's largest wipeouts, with $13 billion exiting several lending platforms, including Aave, which lost $8.54 billion in deposits over 48 hours, resulting in a nearly $200 million bad-debt crisis.