The sophistication of North Korean government-backed hackers is increasing, with these groups now accounting for over 76% of crypto losses this year, totaling nearly $600 million. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack spanning months.

This operation included face-to-face meetings between North Korean intermediaries and Drift employees. As noted by Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'North Korean proxies engaging in in-person meetings with protocol employees over several months is, to my knowledge, unprecedented in North Korea's crypto hacking campaign.' Redbord's comments are part of TRMLabs' latest report, highlighting the significant role of North Korea's primary hacking groups, DPRK and Lazarus, in crypto losses. The report states that these groups are responsible for 76% of all crypto losses due to hacks and exploits in 2026. Redbord emphasized, 'What we're observing is not a broader campaign, but a sharper one.

North Korea is moving faster and more precisely than ever.' The cumulative crypto theft attributed to North Korea now exceeds $6 billion since 2017. TRMLabs' findings coincide with other exploits, such as the Wasabi Protocol hack, which used a similar approach to the Drift hack on April 19, resulting in a $4.5 million loss.

The $292 million KelpDAO breach, on the other hand, exploited a known single-verifier flaw despite repeated warnings from LayerZero. The methods used in the Drift exploit differed significantly from those used in the KelpDAO breach. In the Drift case, hackers converted the stolen funds to USDC, bridged to Ethereum, and swapped them into ETH, with no further movement since the day of the theft, consistent with the DPRK's patient cashout pattern. In contrast, the Lazarus group immediately laundered the KelpDAO proceeds through THORChain and Umbra, involving Chinese intermediaries.

The KelpDAO exploit led to significant wipeouts in DeFi, with $13 billion exiting lending platforms, including Aave, which lost $8.54 billion in deposits over 48 hours, resulting in a nearly $200 million bad-debt crisis. Industry participants are now working to alleviate this crisis with $300 million in pledges.