North Korean Spies' Elaborate Scheme: A $285 Million Heist from Drift

The sophistication of North Korean government-backed hackers is on the rise, with their tactics becoming more refined and precise, resulting in over 76% or nearly $600 million in cryptocurrency losses this year alone. A notable example is the $285 million Drift Protocol exploit, which involved an extraordinary and prolonged in-person social engineering attack, including months of face-to-face meetings between North Korean agents and Drift employees. As Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, noted, 'North Korean agents sitting across a table from protocol employees over several months is, to my knowledge, unprecedented in North Korea's crypto hacking campaign.' This incident highlights a shift from remote operations to more personal and intricate schemes.

TRMLabs' recent report reveals that North Korea's primary hacking groups, DPRK and Lazarus, are accountable for 76% of all cryptocurrency losses due to hacks and exploits in 2026. Redbord stated, 'What we're witnessing is not a broader campaign, but a sharper one.

North Korea is moving faster and more precisely than ever.' The cumulative cryptocurrency theft attributed to North Korea now exceeds $6 billion since 2017. These findings coincide with the Wasabi Protocol exploit, which used a similar approach to the Drift hack on April 19, where attackers utilized a compromised deployer key to drain $4.5 million.

In contrast, the $292 million KelpDAO breach exploited a known single-verifier flaw, despite repeated warnings from LayerZero. The hackers behind the Drift exploit converted the proceeds to USDC, bridged to Ethereum, and swapped them into ETH, which remains untouched since the day of the theft, consistent with the DPRK's patient and multi-year cashout pattern. In contrast, the Lazarus group immediately laundered their KelpDAO proceeds through THORChain and Umbra, using Chinese intermediaries and the well-documented TraderTraitor playbook. The Kelp DAO exploit led to DeFi's largest wipeouts, with $13 billion exiting several lending platforms, including Aave, which lost $8.54 billion in deposits over 48 hours, resulting in a nearly $200 million bad-debt crisis that industry participants are now helping to alleviate with $300 million in pledges.