North Korea's DeFi playbook shifts from code exploits to social engineering as Drift and Kelp losses near $560M in 2026

CoinDesk ties recent DeFi exploits — $270M from Drift (April 1) and $292M from Kelp DAO (April 18) — to a North Korean shift from scanning vulnerable contracts to scanning vulnerable people. The Drift hit was a six-month op where operatives posed as a quant firm, deposited $1M of their own capital, onboarded an Ecosystem Vault, then compromised an admin key to drain five vaults. Chainalysis pegs 2025 North Korean crypto theft at $2.02B, and Q1 2026 alone saw 18 attacks and $300M+ stolen. Takeaway: Lazarus is bringing intelligence-agency patience to DeFi, and teams without rigorous counterintelligence are the soft target.

TLDR by @Benthic

More coverage

• North Korea Aggressively Targeting Crypto Industry with Well ... (ic3.gov)
• Crypto & social engineering: North Korean APTs in 2024 - CyberProof (cyberproof.com)
• North Korean Hackers Use Six-Month Social Engineering Campaign ... (iansresearch.com)
• North Korea-linked actor targets Web3 execs in social-engineering ... (cybersecuritydive.com)
• UNC1069 Targets Cryptocurrency Sector with New Tooling and AI ... (cloud.google.com)

Explore the topic

• Social Engineering
• North Korea
• Exploit
• Kelp