The sophistication and precision of North Korean government-backed hackers have increased, accounting for over 76% of crypto losses, approximately $600 million, in 2026 alone. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack lasting several months. This attack included numerous in-person meetings between North Korean proxies and Drift employees.
As stated by Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'North Korean proxies sitting across a table from protocol employees over a period of months, is to my knowledge, unprecedented in North Korea's crypto hacking campaign.' Redbord's comments are part of TRMLabs' new report, which highlights the significant role of North Korea's two main hacking groups, DPRK and Lazarus, in crypto losses. The report notes that 'what we are watching is not a North Korean campaign that is broader — it is one that is sharper,' with Redbord adding, 'North Korea is moving faster and more precisely than ever.' The cumulative crypto theft by North Korea now exceeds $6 billion since 2017. The findings of TRMLabs coincide with the Wasabi Protocol exploit, which used a similar approach to the Drift hack on April 19, where the attackers used a compromised deployer key to drain $4.5 million.
In contrast to the Drift exploit, the $292 million KelpDAO breach was carried out using a different playbook, exploiting a known single-verifier flaw. The hackers behind the Drift exploit converted the stolen funds to USDC, bridged to Ethereum, and swapped them into ETH, following a pattern consistent with the DPRK's patient, multi-year cashout strategy.