TLDR
North Korea-linked hackers are using long-term infiltration and software supply-chain attacks to compromise major crypto projects and steal large amounts of digital assets.
- Investigators say North Korean operators spent months infiltrating Drift Protocol on Solana and drained roughly $270285 million in a highly planned exploit.
- Security researchers report DPRK IT workers posing as freelancers have embedded themselves in projects such as Shiba Inu (SHIB), SushiSwap, and THORChain, raising software supply-chain risk.
- For users and developers, the biggest risks now come from compromised developer devices, dependencies, and multisig signers rather than just smart contract bugs.
Deep Dive
1. How North Korea Hit Drift
Blockchain analytics firms and a detailed post-mortem indicate that the April 2026 Drift Protocol exploit on Solana was carried out by a state-linked DPRK group (UNC4736 / Lazarus), after a six month social-engineering campaign.
Attackers posed as a quantitative trading firm, met team members at conferences, built trust, then delivered a malicious TestFlight app and exploited a vulnerability in VSCode/Cursor to compromise developer devices and obtain multisig approvals, enabling a durable nonce attack that drained around $270285 million from Drift vaults in under a minute.
Elliptic and others note the laundering pattern matches previous DPRK thefts, with funds quickly consolidated and bridged across chains, consistent with a broader campaign that has already stolen over $300 million in 2026 and historically helped fund North Koreas weapons programs.
Even governance-grade multisig setups can fail if the people and devices behind them are compromised through long-term social contact, conferences, and malware-laced tooling.
2. Infiltration Of Major Projects As Freelancers
A MetaMask security lead, Tayvano, has warned that North Korean IT workers, including Lazarus-linked operators, have reportedly infiltrated major projects as contractors, with examples including allegedly infiltrated projects like Shiba Inu, SushiSwap and THORChain.
These actors often present polished CVs, work remotely, and slowly gain access to codebases or CI pipelines, turning what looks like normal staffing into a pivot point for later thefts or backdoors.
This pattern shifts risk from only on-chain code audits to broader vendor and HR risk, where a single compromised or malicious contributor can seed entire ecosystems with exploitable code paths.
3. Supply-Chain Attacks Beyond Individual Protocols
North Korea-linked groups are also targeting widely used software components, such as when attackers inserted malicious code into an update of the Axios HTTP library, used across banking and crypto-facing web stacks, in a supply-chain attack attributed to DPRK group UNC1069.
Similar campaigns, like the 3CX desktop app compromise, show how routine enterprise tools can become stepping stones into exchanges, brokers, or trading firms, even when those firms never interact with the attackers directly.
For crypto users and teams, this means reviewing not only smart contracts but also build pipelines, libraries, messaging apps, and desktop tools, and treating anything that touches keys or admin accounts as part of the security perimeter.
The more integrated a protocol is with off-the-shelf tools and external freelancers, the more benefit there is in strict device hygiene, key isolation, and aggressive least-privilege access policies.
Conclusion
North Korea-linked groups are evolving from simple exchange hacks into deep, patient operations that infiltrate teams, tooling, and dependencies before striking. For crypto users and builders, the main defense is not just better contracts, but better operational security around who writes and signs code, how devices are hardened, and how much trust is placed in third-party software and remote freelancers.
CoinsKid.Com