The sophistication and precision of North Korean government-backed hackers have increased, now accounting for over 76% or approximately $600 million in cryptocurrency losses this year alone. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack spanning months of face-to-face meetings between North Korean proxies and Drift employees.
As stated by Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'North Korean proxies sitting across a table from protocol employees over a period of months, is, to my knowledge, unprecedented in North Korea's crypto hacking campaign.' This incident highlights the evolution of North Korea's hacking campaigns, which are becoming more targeted and complex. TRMLabs' report reveals that North Korea's two primary hacking groups, DPRK and Lazarus, are responsible for 76% of all cryptocurrency losses due to hacks and exploits in 2026. The report also notes that North Korea's cumulative cryptocurrency theft exceeds $6 billion, attributed to incidents since 2017. Furthermore, the findings coincide with the Wasabi Protocol exploit, which utilized a similar strategy to the Drift hack on April 19, where the attackers used a compromised deployer key to drain $4.5 million.
The $292 million KelpDAO breach, on the other hand, exploited a known single-verifier flaw, resulting in significant losses. The hackers' approach differed significantly from the Drift exploit, as they converted the proceeds to USDC, bridged to Ethereum, and swapped into ETH, without moving the funds since the day of the theft, consistent with the DPRK's patient, multi-year cashout pattern. In contrast, Lazarus immediately laundered the KelpDAO proceeds through THORChain and Umbra, using Chinese intermediaries.
The Kelp DAO exploit led to DeFi's largest wipeouts, with $13 billion exiting several lending platforms, resulting in a significant bad-debt crisis for Aave, which lost $8.54 billion in deposits over 48 hours.