The sophistication of North Korean government-backed hackers has escalated, now accounting for over 76% of crypto losses, totaling nearly $600 million this year alone. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented, months-long in-person social engineering attack. This elaborate scheme featured numerous face-to-face meetings between North Korean proxies and Drift employees.
According to Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'North Korean proxies engaging in in-person meetings with protocol employees over several months is, to my knowledge, a first in North Korea's crypto hacking campaigns.' This approach marks a significant shift from traditional remote hacking operations. TRMLabs' latest report highlights the prominent role of North Korea's two primary hacking groups, DPRK and Lazarus, in crypto losses. Redbord noted, 'The North Korean campaign is becoming more precise, rather than broader.' The report also reveals that North Korea's total crypto theft has surpassed $6 billion since 2017.
The findings coincide with the Wasabi Protocol exploit, which used a similar strategy to the Drift hack on April 19, resulting in a $4.5 million loss. In contrast, the $292 million KelpDAO breach exploited a known vulnerability.
The Drift hackers converted the stolen funds to USDC, bridged to Ethereum, and swapped them into ETH, consistent with the DPRK's patient cashout pattern. In the KelpDAO exploit, however, the hackers immediately laundered the proceeds through THORChain and Umbra, using Chinese intermediaries. The KelpDAO exploit led to DeFi's largest wipeouts, with $13 billion exiting several lending platforms, including Aave, which lost $8.54 billion in deposits over 48 hours.