The sophistication and precision of North Korean government-backed hackers have increased, now accounting for over 76% of crypto losses, approximately $600 million, in 2026 alone. The $285 million Drift Protocol exploit is a prime example, involving an unprecedented in-person social engineering attack that spanned months of face-to-face meetings between North Korean proxies and Drift employees.
As Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, noted, 'North Korean proxies sat across a table from protocol employees for months, which is unprecedented in North Korea's crypto hacking campaign.' TRMLabs' recent report highlights the significant role of North Korea's primary hacking groups, DPRK and Lazarus, in crypto losses, with Redbord stating, 'What we are witnessing is not a broader campaign, but a sharper one. North Korea is moving faster and more precisely than ever.' The cumulative crypto theft by North Korea now exceeds $6 billion since 2017.
The findings coincide with the Wasabi Protocol exploit, which used a similar approach to the Drift hack on April 19, resulting in a $4.5 million loss. In contrast, the $292 million KelpDAO breach exploited a known single-verifier flaw. The hackers behind the Drift exploit converted the stolen funds to USDC, bridged to Ethereum, and swapped them into ETH, consistent with the DPRK's patient cashout pattern. In the KelpDAO exploit, Lazarus immediately laundered the proceeds through THORChain and Umbra, using Chinese intermediaries.
The Kelp DAO exploit led to DeFi's largest wipeouts, with $13 billion exiting several lending platforms, including Aave, which lost $8.54 billion in deposits over 48 hours, resulting in a nearly $200 million bad-debt crisis.