The sophistication of North Korean government-backed hackers has increased, with these groups now accounting for over 76% of crypto losses, totaling nearly $600 million in 2026 alone. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack spanning several months.

This attack included numerous in-person meetings between North Korean proxies and Drift employees. As stated by Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'North Korean proxies sitting across a table from protocol employees over a period of months is, to my knowledge, unprecedented in North Korea's crypto hacking campaign.' This approach signifies a shift from traditional remote hacking operations. The comments from Redbord accompany a new report released by TRMLabs, highlighting how North Korea's primary hacking groups, DPRK and Lazarus, are responsible for 76% of all crypto losses due to hacks and exploits in 2026. Redbord noted, 'What we are watching is not a North Korean campaign that is broader — it is one that is sharper.

North Korea is moving faster and more precisely than ever.' The report also reveals that North Korea's cumulative crypto theft now exceeds $6 billion, attributed to incidents since 2017. TRM Labs' findings coincide with the Wasabi Protocol exploit, which used a similar strategy to the Drift hack on April 19, where assailants utilized a compromised deployer key to drain $4.5 million.

In contrast, the $292 million KelpDAO breach exploited a known single-verifier flaw. The hackers behind the Drift exploit converted the stolen funds to USDC, bridged to Ethereum, and swapped them into ETH, following a patient, multi-year cashout pattern consistent with the DPRK's tactics. Conversely, the Lazarus group immediately laundered the KelpDAO proceeds through THORChain and Umbra. The KelpDAO exploit led to DeFi's largest wipeouts, with $13 billion exiting several lending platforms, resulting in a nearly $200 million bad-debt crisis for Aave, which has received $300 million in pledges to alleviate the issue.