The sophistication and precision of North Korean government-backed hackers have increased, now accounting for over 76% of crypto losses, which is approximately $600 million this year alone. The $285 million Drift Protocol exploit is a prime example, involving an unprecedented in-person social engineering attack that included months of face-to-face meetings between North Korean proxies and Drift employees. As stated by Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, 'North Korean proxies sitting across a table from protocol employees over a period of months, is to my knowledge, unprecedented in North Korea's crypto hacking campaign.' This incident highlights that North Korea's hacking operations have evolved beyond remote keyboard attacks. TRMLabs' recent report reveals that North Korea's primary hacking groups, DPRK and Lazarus, are responsible for 76% of all crypto losses due to hacks and exploits in 2026.
The report also notes that 'North Korea is moving faster and more precisely than ever,' with cumulative crypto theft exceeding $6 billion since 2017. The findings coincide with the Wasabi Protocol exploit, which used a similar strategy to the Drift hack on April 19, where assailants utilized a compromised deployer key to drain $4.5 million. In contrast, the $292 million KelpDAO breach exploited a known single-verifier flaw.
The hackers behind the Drift exploit converted the stolen funds to USDC, bridged to Ethereum, and swapped them into ETH, following the DPRK's patient, multi-year cashout pattern. In contrast, the Lazarus group immediately laundered the KelpDAO proceeds through THORChain and Umbra, using Chinese intermediaries. The Kelp DAO exploit triggered significant wipeouts in DeFi, with $13 billion exiting several lending platforms, resulting in a nearly $200 million bad-debt crisis for Aave.