The sophistication of North Korean government-backed hackers has increased significantly, now accounting for over 76% of crypto losses this year, totaling nearly $600 million. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack spanning several months. This intricate scheme included face-to-face meetings between North Korean representatives and Drift employees. According to Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'North Korean proxies engaging in in-person meetings with protocol employees over an extended period is, to my knowledge, a first in North Korea's crypto hacking campaign.' Redbord's comments are part of TRMLabs' latest report, which highlights the significant role of North Korea's primary hacking groups, DPRK and Lazarus, in crypto losses.
The report notes that 'North Korea is moving faster and more precisely than ever,' with cumulative crypto theft exceeding $6 billion since 2017. The findings also coincide with the Wasabi Protocol exploit, which used a similar approach to the Drift hack on April 19, resulting in a $4.5 million loss. In contrast, the $292 million KelpDAO breach exploited a known single-verifier flaw. The hackers behind the Drift exploit converted the stolen funds to USDC, bridged to Ethereum, and swapped them into ETH, following a patient, multi-year cashout pattern.
In contrast, the KelpDAO proceeds were immediately laundered through THORChain and Umbra, using Chinese intermediaries. The Kelp DAO exploit led to DeFi's largest wipeouts, with $13 billion exiting several lending platforms, including Aave, which lost $8.54 billion in deposits over 48 hours.