North Korean Spies' Elaborate Scheme: A $285 Million Heist from Drift

The sophistication of North Korean government-backed hackers has increased significantly, now accounting for over 76% or approximately $600 million in cryptocurrency losses this year alone. A notable example is the $285 million Drift Protocol exploit, which involved an unprecedented in-person social engineering attack lasting several months.

This attack included numerous in-person meetings between North Korean proxies and Drift employees. As stated by Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'North Korean proxies engaging in face-to-face interactions with protocol employees over an extended period is, to my knowledge, a first in North Korea's cryptocurrency hacking campaign.' This method of operation has evolved beyond remote keyboard attacks.

The comments from Redbord accompany TRMLabs' latest report, released on Thursday, highlighting the significant role of North Korea's primary hacking groups, DPRK and Lazarus, in cryptocurrency losses due to hacks and exploits in 2026, accounting for 76% of all losses. Redbord noted, 'The North Korean campaign is becoming more refined, rather than broader.' The report also reveals that North Korea's cumulative cryptocurrency theft now surpasses $6 billion, attributed to incidents since 2017. Furthermore, TRMLabs' findings coincide with the Wasabi Protocol exploit, which utilized a similar approach to the Drift hack on April 19, where attackers used a compromised deployer key without a timelock or multisig to drain $4.5 million. In contrast to the Drift exploit, the $292 million KelpDAO breach exploited a known single-verifier flaw that LayerZero had previously warned against.

The methods used by the hackers differed significantly from the Drift exploit, as they converted the Drift proceeds to USDC, bridged to Ethereum, and swapped into ETH, with no movement of the funds since the day of the theft, consistent with the DPRK's patient, multi-year cashout pattern. In contrast, Lazarus immediately laundered the KelpDAO proceeds through THORChain and Umbra, primarily handled by Chinese intermediaries using the well-documented TraderTraitor playbook, as explained in the report.

The KelpDAO exploit led to DeFi's largest wipeouts, with $13 billion exiting several lending platforms, most notably Aave, which lost $8.54 billion in deposits over 48 hours, resulting in a nearly $200 million bad-debt crisis that industry participants are now helping to alleviate with $300 million in pledges.