North Korean hackers steal $285M from crypto

TLDR

A North Korea backed hacking group has reportedly stolen about $285 million from multiple crypto platforms over six months, mainly by targeting people and infrastructure instead of core blockchains.

1. A state sponsored group dubbed UNC4736 stole roughly $285 million using social engineering and infrastructure exploits on platforms including Drift Protocol.
2. The heist is part of a wider North Korea linked campaign that has pushed monthly DeFi losses above $600 million and triggered multibillion dollar outflows.
3. The main defense for most users is better operational security: resisting social engineering, isolating high value keys, and monitoring protocol security responses.

Deep Dive

1. Six Month Operation And Tactics

Security researchers report that a North Korean state backed group known as UNC4736 stole about $285 million from several crypto platforms over a six month campaign, combining access to multiple targets into one large haul. That campaign relied heavily on social engineering against teams like Solana based Drift Protocol and abuse of Solana durable nonce infrastructure rather than direct L1 consensus failures, according to one detailed write up of the operation. In practice, attackers posed as legitimate business contacts at conferences and online, built trust over weeks, then convinced staff to sign malicious transactions or install compromised software, a pattern echoed in broader coverage of recent large heists that began with social engineering against Drift and others.

2. Part Of A Larger North Korea Campaign

North Korea linked groups, often grouped under the Lazarus label, have also been tied to a roughly $292 million exploit of KelpDAOs rsETH bridge and laundering of funds through ThorChain and other DeFi rails. One analysis estimates that the KelpDAO incident alone helped trigger about $13 billion in DeFi total value locked outflows as leveraged positions unwound and users rotated liquidity. In April, total hacked value across crypto protocols has already exceeded $623 million with several days left in the month, with North Korean groups responsible for two of the largest attacks in that tally. Prediction markets tracking another $100 million plus crypto hack this year now price that outcome near certainty, reflecting how structural and recurring these state backed operations look to traders.

3. Practical Lessons For Crypto Users

Recent reporting stresses that hacking humans rather than systems is now the primary entry point for many of the biggest thefts, including the Drift related attack. For individuals, high impact mitigations include hardware wallets for long term holdings, strict separation between experiment wallets and core savings, and a default suspicion toward unsolicited files, browser extensions, and signing requests, especially after conference meetups. For DeFi users and builders, monitoring security advisories and post mortems from firms such as Chainalysis and CertiK, plus following how protocols respond with circuit breakers or architecture changes, can help you gauge whether risk is being reduced or simply shifted.

Conclusion

North Korea linked hacking groups have turned sustained social engineering and infrastructure exploitation into hundreds of millions of dollars in stolen crypto, with the $285 million UNC4736 campaign as a prominent example. These attacks increasingly hit bridges, DeFi protocols, and project teams rather than core chains, driving volatility and temporary DeFi outflows but not killing the sector. For crypto users, the edge lies in treating human and operational security as seriously as on chain risk, and in favoring protocols and venues that demonstrate clear, evolving defenses against this new class of state backed threats.