North Korean Spies' Elaborate Scheme: $285 Million Stolen from Drift in Months-Long Heist

The sophistication of North Korean government-backed hackers has increased, with these groups now accounting for over 76% of crypto losses this year, totaling nearly $600 million. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack lasting months. This attack, described by TRMLabs, included prolonged in-person meetings between North Korean proxies and Drift employees.

According to Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, this level of in-person engagement is unprecedented in North Korea's crypto hacking campaigns. Redbord noted, 'This is no longer just a remote operation, it's a face-to-face engagement.' TRMLabs' recent report highlights how North Korea's primary hacking groups, DPRK and Lazarus, are responsible for 76% of all crypto losses due to hacks and exploits in 2026. The report states, 'What we're seeing is not a broader campaign, but a sharper one. North Korea is moving faster and more precisely than ever.' The total crypto theft attributed to North Korea now exceeds $6 billion since 2017.

The findings from TRMLabs coincide with the Wasabi Protocol exploit, which used a similar method to the Drift hack on April 19, where attackers used a compromised deployer key to drain $4.5 million. Another exploit, the $292 million KelpDAO breach, utilized a known single-verifier flaw that LayerZero had previously warned against.

The methods used in the Drift exploit differed significantly from other attacks. The hackers converted the stolen Drift funds to USDC, bridged to Ethereum, and then swapped them into ETH, after which the funds remained unmoved, consistent with the DPRK's patient, multi-year cashout strategy. In contrast, the Lazarus group immediately laundered the KelpDAO proceeds through THORChain and Umbra, primarily using Chinese intermediaries.

The KelpDAO exploit led to significant losses in DeFi, with $13 billion exiting several lending platforms, most notably Aave, which lost $8.54 billion in deposits over 48 hours and now faces a nearly $200 million bad-debt crisis. Industry participants are currently working to alleviate this crisis with $300 million in pledges.