North Korean hackers steal $285M from DeFi

TLDR

North Korea-linked hackers are reported to have stolen about $285 million from DeFi platforms in a months-long campaign targeting critical infrastructure and user-facing weaknesses.

1. A DPRK-linked group dubbed UNC4736 allegedly drained around $285 million from platforms like Drift Protocol using social engineering and Solanas durable nonce quirks.
2. The theft is part of a broader pattern where North Korean units, including Lazarus, focus on DeFi bridges and restaking infrastructure, triggering multi-billion dollar TVL drawdowns across DeFi.
3. DeFi teams are now hardening cross-chain messaging, verifier setups, and access controls, but security firms and even prediction markets still expect further large hacks.

Deep Dive

1. How The $285M Was Stolen

According to one detailed investigation, a North Korean state-backed group labeled UNC4736 stole about $285 million from crypto platforms over six months, largely via Drift Protocol and related Solana DeFi targets. The group combined social engineering with exploitation of Solanas durable nonce mechanism and operational misconfigurations on targeted platforms, enabling large unauthorized withdrawals without immediately triggering safeguards. Analysts link UNC4736 and similar units to North Koreas broader cyber apparatus, which has stolen billions from crypto since 2017, often to fund sanctioned state programs.

2. Why This Hits DeFi So Hard

This $285 million campaign sits alongside other DPRK-linked exploits such as the roughly $292 million KelpDAO restaking hack, which was tied to North Koreas Lazarus Group and shook confidence in LayerZero-based cross-chain infrastructure, causing a double-digit billion outflow from DeFi TVL in days. In the KelpDAO case, attackers compromised RPC infrastructure feeding a single verifier configuration, showing that weaknesses at the plumbing layer can cascade into losses for lending protocols and restaking users far beyond the initial target. The pattern is clear: sophisticated state actors are targeting the connective tissue of DeFi where large values aggregate.

3. Security Shifts And What To Watch

In response, infrastructure providers are pushing multi-verifier setups, stricter RPC and key management, and better monitoring of cross-chain message paths, while some governance bodies, like the Arbitrum Security Council, have resorted to freezing funds linked to exploits. Security firms and on-chain analysts now treat North Korean state actors as a structural, ongoing risk to DeFi, and one prediction market summarized in the same reporting prices another $100 million-plus hack this year as almost certain.

Conclusion

North Korea-linked hackers draining around $285 million from DeFi is less a one-off shock and more a continuation of a well-resourced, state-backed campaign that targets the infrastructure where crypto value concentrates. Until cross-chain, restaking, and RPC layers are treated with bank-grade security and independent verification, DeFi will remain attractive terrain for these attackers, and large, sudden losses will stay a key regime risk for anyone relying on decentralized protocols.