The sophistication and precision of North Korean government-backed hackers have increased significantly, accounting for over 76% of crypto losses this year, totaling nearly $600 million. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack. Over several months, North Korean proxies engaged in in-person meetings with Drift employees.
According to Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, this tactic is a new development in North Korea's crypto hacking campaign, marking a shift from remote operations. TRMLabs' latest report highlights the role of North Korea's primary hacking groups, DPRK and Lazarus, in 76% of all crypto losses due to hacks and exploits in 2026. The report notes that North Korea's approach has become more targeted and swift, with cumulative crypto theft exceeding $6 billion since 2017.
The findings coincide with the Wasabi Protocol exploit, which used a similar approach to the Drift hack on April 19, resulting in a $4.5 million loss. In contrast, the $292 million KelpDAO breach exploited a known single-verifier flaw despite repeated warnings from LayerZero. The Drift exploit involved converting proceeds to USDC, bridging to Ethereum, and swapping into ETH, with no movement of the funds since the theft, consistent with the DPRK's patient cashout pattern.
In contrast, the KelpDAO exploit involved immediate laundering through THORChain and Umbra, characteristic of the Lazarus group's tactics. The Kelp DAO exploit led to significant wipeouts in DeFi, with $13 billion exiting several lending platforms, including Aave, which lost $8.54 billion in deposits over 48 hours, resulting in a nearly $200 million bad-debt crisis.