North Korean government-supported hackers have significantly improved their tactics, now accounting for over 76% of crypto losses, which is nearly $600 million this year alone. The $285 million Drift Protocol exploit is a prime example, involving an extraordinary and prolonged in-person social engineering attack. This complex scheme included months of face-to-face meetings between North Korean intermediaries and Drift employees. As described by Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, "North Korean proxies sat across a table from protocol employees for months, which is unprecedented in North Korea's crypto hacking campaign.
This is no longer just a remote operation." TRMLabs' new report highlights how North Korea's primary hacking groups, DPRK and Lazarus, are responsible for 76% of all crypto losses due to hacks and exploits in 2026. According to Redbord, "What we're witnessing is not a broader campaign, but a sharper one. North Korea is moving faster and more precisely than ever." The report also notes that North Korea's cumulative crypto theft now exceeds $6 billion since 2017.
These findings coincide with the Wasabi Protocol exploit, which used a similar approach to the Drift hack on April 19, where the attackers used a compromised deployer key to drain $4.5 million. In contrast to the Drift exploit, the $292 million KelpDAO breach exploited a known single-verifier flaw. The hackers behind the Drift exploit converted the stolen funds to USDC, bridged to Ethereum, and swapped them into ETH, which is consistent with the DPRK's patient, multi-year cashout pattern. In contrast, Lazarus immediately laundered the KelpDAO proceeds through THORChain and Umbra, using Chinese intermediaries.
The Kelp DAO exploit triggered significant losses in DeFi, with $13 billion exiting several lending platforms, including Aave, which lost $8.54 billion in deposits over 48 hours.