The sophistication of North Korean government-backed hackers has increased significantly, now accounting for over 76% or roughly $600 million in crypto losses this year alone. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack spanning months of face-to-face meetings between North Korean proxies and Drift employees. As Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, noted, 'North Korean proxies sitting across a table from protocol employees over a period of months, that is, to my knowledge, unprecedented in North Korea's crypto hacking campaign.' This approach marks a departure from traditional remote hacking operations.
The comments accompany TRMLabs' new report, highlighting the role of North Korea's primary hacking groups, DPRK and Lazarus, in 76% of all crypto losses due to hacks and exploits in 2026. Redbord emphasized, 'What we are watching is not a North Korean campaign that is broader — it is one that is sharper.
North Korea is moving faster and more precisely than ever.' The cumulative crypto theft attributed to North Korea now exceeds $6 billion since 2017. The findings coincide with the Wasabi Protocol exploit, which used a similar playbook to the Drift hack on April 19, where assailants utilized a compromised deployer key to drain $4.5 million.
In contrast, the $292 million KelpDAO breach exploited a known single-verifier flaw. The hackers behind the Drift exploit converted the proceeds to USDC, bridged to Ethereum, and swapped into ETH, following the DPRK's patient, multi-year cashout pattern. Conversely, Lazarus immediately laundered the KelpDAO proceeds through THORChain and Umbra, consistent with the TraderTraitor playbook.
The Kelp DAO exploit led to DeFi's largest wipeouts, with $13 billion exiting several lending platforms, including Aave, which lost $8.54 billion in deposits over 48 hours, resulting in a nearly $200 million bad-debt crisis.