The North Korean government's hacking groups have become increasingly advanced, now accounting for over 76% of crypto losses this year, with nearly $600 million stolen. The $285 million Drift Protocol exploit involved an unprecedented in-person social engineering attack, with months of face-to-face meetings between North Korean proxies and Drift employees.
According to Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'North Korean proxies sitting across a table from protocol employees over a period of months is unprecedented in North Korea's crypto hacking campaign.' TRMLabs' new report highlights how North Korea's two main hacking groups, DPRK and Lazarus, are responsible for 76% of all crypto losses to hacks and exploits in 2026. The report also notes that North Korea's cumulative crypto theft now exceeds $6 billion attributed incidents since 2017.
The findings coincide with a Wasabi Protocol exploit using a similar playbook to Drift's April 19 hack, where the assailants used a compromised deployer key to drain $4.5 million. The $292 million KelpDAO breach exploited a known single-verifier flaw, and the playbook was vastly different from the Drift exploit. The hackers converted the Drift proceeds to USDC, bridged to Ethereum, swapped into ETH, and have not moved them since the day of the theft, consistent with the DPRK's patient, multi-year cashout pattern.