North Korean Hackers Drain $285 Million from Drift Protocol in Unprecedented In-Person Social Engineering Attack

North Korean state-backed hackers executed a sophisticated $285 million exploit against Drift Protocol through an unprecedented in-person social engineering campaign that involved months of face-to-face meetings with protocol employees, according to security intelligence firm TRMLabs.

Market Context

The attack on Drift Protocol is part of a broader escalation in North Korean cyber operations targeting decentralized finance platforms. TRMLabs' latest threat report reveals that DPRK and Lazarus Group, the two primary state-sponsored hacking outfits operating out of North Korea, now account for 76% of all cryptocurrency losses stemming from hacks and exploits in 2026, representing nearly $600 million this year alone.

The timing of these attacks has created significant market turmoil. The $292 million KelpDAO breach triggered what industry participants are calling DeFi's largest wipeout event, with approximately $13 billion exiting multiple lending platforms over a 48-hour period. Aave bore the brunt of the exodus, losing $8.54 billion in deposits and facing a nearly $200 million bad-debt crisis that required $300 million in community pledges to stabilize.

Analysis

Ari Redbord, Global Head of Policy and Government Affairs at TRMLabs, described the Drift Protocol operation as representing a fundamental shift in North Korean cyber tactics.

"North Korean proxies sitting across a table from protocol employees over a period of months. That is, to my knowledge, unprecedented in North Korea's crypto hacking campaign," Redbord told CoinDesk. "This is no longer just a remote keyboard operation."

The sophistication of the Drift attack extended beyond its execution to its subsequent money laundering. Hackers converted the stolen proceeds to USDC, bridged the funds to Ethereum, swapped into ETH, and have not moved the assets since the day of the theft—a pattern consistent with DPRK's patient, multi-year cashout strategy that allows funds to mature before liquidation.

In contrast, the Lazarus Group took a different approach with its KelpDAO exploit. The attackers immediately laundered proceeds through THORChain and Umbra using what TRMLabs describes as the "TraderTraitor playbook," a well-documented scheme operated predominantly by Chinese intermediaries.

Redbord characterized the broader trend in the report: "What we are watching is not a North Korean campaign that is broader—it is one that is sharper. North Korea is moving faster and more precisely than ever."

The Wasabi Protocol exploit on April 19 employed similar tactics to Drift, using a compromised deployer key with no timelock or multisig protection to drain $4.5 million. The KelpDAO breach exploited a known single-verifier flaw that LayerZero had repeatedly warned against in security communications.

Key Numbers

- $285 million drained from Drift Protocol through in-person social engineering attack spanning months

- 76% of all crypto exploit losses in 2026 attributed to North Korean state-backed groups

- Nearly $600 million stolen in crypto exploits year-to-date by DPRK and Lazarus

- $6 billion cumulative cryptocurrency theft by North Korea since 2017

- $292 million KelpDAO breach that triggered $13 billion in platform exits

- $8.54 billion in deposits lost from Aave over 48 hours following the exploit

- Nearly $200 million bad-debt crisis facing Aave, offset by $300 million in community pledges

What to Watch

Security experts emphasize that these attacks represent a tactical evolution requiring DeFi protocols to reassess their operational security. TRMLabs has indicated its full threat report contains additional details on North Korean methodologies that could inform defensive strategies.

The unaudited funds from the Drift exploit remain unmoved since the theft, suggesting an extended holding period consistent with DPRK's historical cashout patterns. Market participants should monitor for any movement of these assets through standard blockchain analytics channels.

For protocols utilizing LayerZero infrastructure, the KelpDAO breach exploited a known vulnerability that had been repeatedly flagged—underscoring the importance of implementing recommended security configurations and multisig protections.

The broader DeFi ecosystem's response to Aave's bad-debt crisis will serve as a test case for community-led recovery mechanisms following large-scale exploits.