The sophistication of North Korean government-backed hackers is on the rise, with these groups now accounting for over 76% of crypto losses, totaling nearly $600 million in 2026 alone. A notable example is the $285 million Drift Protocol exploit, which involved an extensive in-person social engineering attack. This elaborate scheme, described by TRMLabs, entailed months of face-to-face meetings between North Korean operatives and Drift employees.
As stated by Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'North Korean proxies sitting across a table from protocol employees over a period of months, is, to my knowledge, unprecedented in North Korea's crypto hacking campaign.' This marks a significant shift from traditional remote hacking operations. The comments accompany TRMLabs' recent report, highlighting the role of North Korea's primary hacking groups, DPRK and Lazarus, in 76% of crypto losses due to hacks and exploits in 2026. According to Redbord, 'What we are watching is not a North Korean campaign that is broader — it is one that is sharper. North Korea is moving faster and more precisely than ever.' The cumulative crypto theft attributed to North Korea now exceeds $6 billion since 2017.
TRMLabs' findings coincide with the Wasabi Protocol exploit, which used a similar strategy to the Drift hack on April 19, where assailants utilized a compromised deployer key to drain $4.5 million. In contrast, the $292 million KelpDAO breach exploited a known single-verifier flaw. The tactics employed in the Drift exploit differed significantly, with hackers converting proceeds to USDC, bridging to Ethereum, and swapping into ETH, consistent with the DPRK's patient cashout pattern.
In the KelpDAO exploit, Lazarus immediately laundered the proceeds through THORChain and Umbra, involving Chinese intermediaries. The Kelp DAO exploit led to DeFi's largest wipeouts, with $13 billion exiting several lending platforms, resulting in a nearly $200 million bad-debt crisis for Aave.