The sophistication and precision of North Korean government-backed hackers have increased significantly, now accounting for over 76% or approximately $600 million in cryptocurrency losses this year alone. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack lasting several months.
This attack included numerous in-person meetings between North Korean proxies and Drift employees. According to Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, "North Korean proxies sitting across a table from protocol employees over a period of months is, to my knowledge, unprecedented in North Korea's crypto hacking campaign. This is no longer just a remote operation." TRMLabs' latest report highlights how North Korea's primary hacking groups, DPRK and Lazarus, are responsible for 76% of all cryptocurrency losses due to hacks and exploits in 2026. Redbord noted, "What we are witnessing is not a broader North Korean campaign, but a sharper one.
North Korea is moving faster and more precisely than ever." The report also states that North Korea's cumulative cryptocurrency theft now exceeds $6 billion since 2017. These findings coincide with the Wasabi Protocol exploit, which used a similar approach to the Drift hack on April 19, where the attackers used a compromised deployer key to drain $4.5 million.
In contrast, the $292 million KelpDAO breach exploited a known single-verifier flaw. The methods used by the hackers differed significantly from the Drift exploit, according to TRMLabs.
The Drift proceeds were converted to USDC, bridged to Ethereum, and swapped into ETH, with no movement since the day of the theft, consistent with the DPRK's patient cashout pattern. In contrast, Lazarus immediately laundered the KelpDAO proceeds through THORChain and Umbra, predominantly handled by Chinese intermediaries using the well-documented TraderTraitor playbook.