The long con: How North Korean spies spent months in-person to drain $285 million from Drift

TRM Labs reports North Korean state-backed groups (DPRK, Lazarus) are now responsible for roughly 76% of crypto hack losses in 2026 (nearly $600M), and over $6 billion cumulatively since 2017. Recent high-profile exploits — a $285M Drift breach using months-long in-person social engineering, a $292M KelpDAO exploit and a $4.5M Wasabi admin key compromise — have triggered major DeFi stress, including roughly $13B in TVL outflows and a collapse in Aave deposits that produced a nearly $200M bad-debt issue. The incidents have forced industry-led rescue pledges (~$300M) and highlight evolving attacker tactics (in-person ops, key compromises, rapid laundering), raising counterparty, custody and liquidity risks across crypto and DeFi and likely increasing market risk aversion.