Cash

Drift

ZachXBT

Tornado Cash

Tornado

This month’s $285 million exploit on Drift, a decentralized exchange (DEX), was the largest crypto hack in over a year, when exchange Bybit lost $1.4 billion. North Korean state-backed hackers were named as prime suspects in both attacks.
This past autumn, attackers posed as a quantitative trading firm and approached Drift’s protocol team in person at a major crypto conference, said Drift in an X <a href="https://x.com/DriftProtocol/status/2040611161121370409?s=20" rel="noopener noreferrer nofollow">post</a> Sunday.
“It is now understood that this appears to be a targeted approach, where individuals from this group continued to deliberately seek out and engage specific Drift contributors, in person, at multiple major industry conferences in multiple countries over the following six months,” said the DEX.
Until now, North Korean cyber spies have targeted crypto firms online, through virtual calls and remote work. An in-person approach at a conference would not typically raise suspicion, but the Drift exploit should be enough for attendees to review connections made at recent events.
<figure><img src="https://s3.cointelegraph.com/uploads/2026-04/019d71ff-97d8-731d-9a2c-ff67b5527bb0.jpg" alt="North Korean cyber spies are no longer just remote threats">
 <figcaption>The hack cut Drift’s TVL by more than half in about 12 minutes. Source: <a href="https://defillama.com/protocol/drift?fees=false" rel="noopener noreferrer nofollow">DefiLlama</a>
 </figcaption>
</figure>
<h2 id="north-korea-expands-crypto-playbook-beyond-hacks">North Korea expands crypto playbook beyond hacks</h2>
Blockchain forensics firm TRM Labs described the incident as the largest DeFi hack of 2026 (so far) and the second-largest exploit in Solana’s history, just behind the <a href="https://cointelegraph.com/news/wormhole-token-bridge-loses-321m-in-largest-hack-so-far-in-2022" rel="noopener noreferrer nofollow">$326 million Wormhole bridge hack in 2022</a>.
The initial contact dates back about six months, but the exploit itself traces to mid-March, according to TRM. The attacker began by moving funds from Tornado Cash and deploying the CarbonVote Token (CVT), while using social engineering to persuade multisig signers to approve transactions that granted elevated permissions.
They then manufactured credibility for CVT by minting a large supply and inflating trading activity to simulate real demand. Drift’s oracles picked up the signal and treated the token as a legitimate asset.
When the pre-approved transactions were executed on April 1, CVT was accepted as collateral, withdrawal limits were increased and funds were withdrawn in real assets, including USDC.
<figure><img src="https://s3.cointelegraph.com/uploads/2026-04/019d7200-d350-7ac5-9802-e63d1d9ad394.jpeg" alt="North Korean cyber spies are no longer just remote threats">
 <figcaption>TRM outlines funds moving from Tornado Cash in March used to prepare for the Drift exploit. Source: <a href="https://www.trmlabs.com/resources/blog/north-korean-hackers-attack-drift-protocol-in-285-million-heist" rel="noopener noreferrer nofollow">TRM Labs</a>
 </figcaption>
</figure>
Related: <a href="https://cointelegraph.com/features/north-korean-spy-reveals-ties-in-fake-job-interview" rel="noopener noreferrer nofollow">North Korean spy slips up, reveals ties in fake job interview</a>
According to TRM, the speed and aggressiveness of the subsequent laundering exceeded <a href="https://cointelegraph.com/news/thorchain-swap-explosion-to-1-b-in-two-days-amid-bybit-exploit" rel="noopener noreferrer nofollow">that seen in the Bybit hack</a>.
North Korea is widely believed to be using large-scale crypto thefts such as the Drift and Bybit attacks alongside longer-term tactics, including placing operatives in remote roles at tech and crypto firms to generate steady income. The <a href="https://docs.un.org/en/S/2023/656" rel="noopener noreferrer nofollow">United Nations Security Council</a> has said such funds are used to support the country’s weapons program.
Security researcher Taylor Monahan <a href="https://x.com/tayvano_/status/2040664577168547920" rel="noopener noreferrer nofollow">said</a> infiltration of DeFi protocols dates back to “DeFi summer,” adding that around 40 protocols have had contact with suspected DPRK operatives.
North Korean state media reported Thursday that the country tested an electromagnetic weapon and a short-range ballistic missile, known as the Hwasong-11, fitted with cluster munition warheads.
<figure><img src="https://s3.cointelegraph.com/uploads/2026-04/019d7201-69d3-72a1-9ac2-e71e4063b1ee.jpg" alt="North Korean cyber spies are no longer just remote threats">
 <figcaption>Estimated dimensions for the KN-23, also known as the Hwasong-11A. Source: <a href="https://www.nonproliferation.eu/hcoc/wp-content/uploads/2023/01/NORTH-KOREAN-SHORT-RANGE-SYSTEMS-1.pdf" rel="noopener noreferrer nofollow">Christian Maire, FRS</a>
 </figcaption>
</figure>
<h2 id="infiltration-network-fuels-steady-crypto-revenue">Infiltration network fuels steady crypto revenue</h2>
A separate investigation revealed how a network of North Korea-linked IT workers generated millions through prolonged infiltration.
Data obtained from an anonymous source shared by ZachXBT showed the network posing as developers and embedding themselves across crypto and tech firms, generating roughly $1 million a month and <a href="https://cointelegraph.com/news/north-korea-it-worker-hacked-exposing-fraud-scam-operation" rel="noopener noreferrer nofollow">more than $3.5 million since November</a>.
The group secured jobs using falsified identities, routed payments through a shared system, then converted funds to fiat and sent them to Chinese bank accounts via platforms such as Payoneer.
<figure><img src="https://s3.cointelegraph.com/uploads/2026-04/019d7201-d11a-7c42-add5-a637d2e73374.jpg" alt="North Korean cyber spies are no longer just remote threats">
 <figcaption>Wallet tracing linked part of the flow to addresses tied to known DPRK activity, the blockchain sleuth said. Source: <a href="https://x.com/zachxbt/status/2041873525502570919" rel="noopener noreferrer nofollow">ZachXBT</a>
 </figcaption>
</figure>
Related: <a href="https://cointelegraph.com/features/freelancer-north-korean-spies-may-using-you" rel="noopener noreferrer nofollow">Are you a freelancer? North Korean spies may be using you</a>
The operation relied on basic infrastructure, including a shared website with a common password and internal leaderboards tracking earnings.&nbsp;
The agents applied for roles in plain sight using VPNs and fabricated documents, pointing to a longer-term strategy of embedding operatives to extract steady revenue.
<h2 id="defenses-evolve-as-infiltration-tactics-spread">Defenses evolve as infiltration tactics spread</h2>
Cointelegraph encountered a similar scheme in a 2025 investigation led by Heiner García, who spent months in contact with a suspected operative.
Cointelegraph later took part in García’s dummy interview with a suspect who went by “Motoki,” who claimed to be Japanese. The suspect rage quit the call after failing to introduce himself in his supposed native dialect.
The investigation found operatives bypassed geographic restrictions by using remote access to devices physically located in countries such as the US. Instead of VPNs, they operated those machines directly, making their activity appear local.
By now, tech headhunters have realized that the person at the other end of a virtual job interview may indeed be a North Korean cyber spy. A viral defence strategy is to ask suspects to insult Kim Jong Un. So far, the tactic has been effective.
<figure><img src="https://s3.cointelegraph.com/uploads/2026-04/019d7202-53cf-7edc-a5b9-33ddc327e399.jpg" alt="North Korean cyber spies are no longer just remote threats">
 <figcaption>A suspected North Korean IT worker freezes when asked to call Kim Jong Un a “fat, ugly pig.” Source: <a href="https://x.com/tanuki42_/status/2041096021300928759" rel="noopener noreferrer nofollow">Tanuki42</a>
 </figcaption>
</figure>
However, as Drift was approached in person and García’s findings showed operatives finding creative methods to bypass geographic restrictions, North Korean actors have continued to adapt to the cat-and-mouse dynamic.
Requesting interviewees to call North Korea’s supreme leader a “fat pig” is an effective strategy for the time being, but security researchers warn that this won’t work forever.
Magazine: <a href="https://cointelegraph-magazine.com/taiwan-advised-btc-drift-hack-north-korea-asia-express/" rel="noopener noreferrer nofollow">Phantom Bitcoin checks, China tracks tax on blockchain: Asia Express</a>

North Korean cyber spies are no longer just remote threats

Table of Contents

Cointelegraph

Other articles published on Apr 9, 2026

Join our free newsletter for daily crypto updates!