The sophistication of North Korean government-backed hackers has increased significantly, now accounting for over 76% of crypto losses, totaling nearly $600 million in 2026 alone. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented, long-term in-person social engineering attack. Over several months, North Korean proxies engaged in face-to-face meetings with Drift employees. According to Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'North Korean proxies sitting across a table from protocol employees over a period of months is, to my knowledge, unprecedented in North Korea's crypto hacking campaign.' This approach marks a shift from traditional remote operations.
TRMLabs' recent report highlights the significant role of North Korea's primary hacking groups, DPRK and Lazarus, in crypto losses, responsible for 76% of all crypto losses due to hacks and exploits in 2026. Redbord noted, 'What we are watching is not a North Korean campaign that is broader — it is one that is sharper. North Korea is moving faster and more precisely than ever.' The cumulative crypto theft by North Korea now exceeds $6 billion since 2017. The findings coincide with other exploits, such as the Wasabi Protocol hack, which used a similar strategy to drain $4.5 million.
In contrast, the $292 million KelpDAO breach exploited a known vulnerability. The hackers behind the Drift exploit converted the stolen funds to USDC, bridged to Ethereum, and swapped them into ETH, following a patient, multi-year cashout pattern characteristic of the DPRK. In the KelpDAO exploit, Lazarus immediately laundered the proceeds through THORChain and Umbra, using Chinese intermediaries. The KelpDAO exploit led to significant withdrawals from lending platforms, resulting in a nearly $200 million bad-debt crisis for Aave, which is being alleviated with $300 million in pledges from industry participants.