North Korean hackers infiltrate major crypto projects

TLDR

North Korean state-linked hackers are implicated in a huge Drift Protocol exploit and are alleged to have quietly worked inside multiple major crypto projects for years.

1. A North Korea affiliated group spent six months infiltrating Solana based Drift Protocol before draining about 270285 million dollars via a targeted social engineering and malware attack.
2. Onchain analyst Tayvano alleges North Korean IT workers have contributed code to many well known protocols, creating long term software supply chain risk for DeFi and token projects.
3. For users and builders, the main impact is higher trust and insider risk, making project security culture, hiring practices and incident transparency more important than ever.

Deep Dive

1. Drift Hack Shows Long Game Infiltration

Drift Protocol reported that its April 1 exploit, roughly 270285 million dollars, followed a six month operation by a North Korean state linked group posing as a quantitative trading firm, later attributed to UNC4736 (AppleJeus or Citrine Sleet) in on chain and forensic analysis. The attackers first met Drift contributors at conferences, deposited over 1 million dollars into an Ecosystem Vault, then used a malicious TestFlight app and a VSCode or Cursor vulnerability to compromise devices and obtain multisig approvals before draining funds in under a minute, as detailed in a six month intelligence operation on Drift Protocol. A crypto attorney argued the incident may rise to civil negligence because Drift did not keep signing keys on air gapped systems or properly vet new collaborators met at events, according to a legal analysis of the Drift incident.

2. Alleged Deep Presence Inside Major Protocols

MetaMask security director Tayvano disclosed research indicating North Korean IT specialists, including Lazarus linked actors, allegedly infiltrated multiple major projects such as Shiba Inu, SushiSwap and THORChain, often posing as senior freelancers since at least 2020, according to a report on alleged DPRK infiltration of top crypto projects. Another analysis notes claims that North Korean developers have participated in building multiple major DeFi protocols since the DeFi summer period, using remote work, false identities and contractor roles to gain access to codebases and teams, as described in a summary of North Korean developers linked to crypto protocols. These infiltration claims are partly analytic rather than fully documented, but they align with patterns cited by US and allied authorities about DPRK tactics.

3. Why It Matters And How Risk Shifts

North Korean hacking units have caused more than 300 million dollars in losses in recent months alone, raising the stakes for any protocol that holds or routes large amounts of user funds, according to the same MetaMask backed investigation. For project teams, the main pressure points are social engineering at conferences, lax contractor vetting, and poor separation between development machines and signing infrastructure. For users, the practical risk is that even audited or brand name protocols can harbor hidden backdoors or governance weaknesses if attackers have quietly influenced design or tooling over time.

Conclusion

North Korean cyber units are no longer just external thieves probing smart contracts; they are alleged to be embedded contributors and long game social engineers inside major crypto projects. That shifts the focus of risk from narrow code bugs to broader operational and governance practices, making project level security culture and transparent incident reporting crucial signals for crypto users to monitor.