A $280 million exploit against Drift Protocol last week wasn’t just a heist — it was the latest operation tied to a network of North Korean agents who have quietly worked inside some of crypto’s biggest projects for years.
Seven Years Of Cover, 40+ Platforms BreachedTheir infiltration goes back to what the industry calls “DeFi Summer” — roughly 2020, when decentralized finance exploded in popularity.
oh god uhhhh like sushi, thorchain, yam, pickle, harvest, reclaim, swing, paid, naos, shezmu, qrolli, saffron, sifu, napier, harmony, blueberry, stabble, onering, elemental, divvy, la token, impermax, kira, cook, fantom, ankr, gamerse, metaplay, spice, beanstalk, deltaprime,…
Monahan said the “seven years of blockchain development experience” these workers list on their resumes isn’t fabricated. They actually built the protocols.
Reportedly:
In 2026 Lazarus made 18 attacks on protocols in 3 months
Stolen funds are funding “North Korea’s Nuclear Weapons”
It’s the most successful venture fund built on hacks
Not All North Korean — Third-Party Proxies Now InvolvedWhat sets the Drift case apart is who showed up in person. The protocol said that face-to-face meetings connected to the breach were not conducted by North Korean nationals.
Instead, reports indicate the group used third-party intermediaries — people with built-out fake identities, fabricated employment histories, and professional networks constructed to pass scrutiny.
Lazarus Group is the collective name for all DPRK state sponsored cyber actors.
The main issue is everyone groups them all together when the complexity of threats are different.
Sleuth: Companies That Still Fall For This Are NegligentBlockchain investigator ZachXBT pushed back on how the industry discusses these threats, saying not all attack types carry the same weight.
Recruitment-based schemes — job postings, LinkedIn outreach, Zoom interviews — are, in his words, basic. They require no technical sophistication. What makes them effective is sheer persistence.
“If you or your team still falls for them in 2026, you’re very likely negligent,” ZachXBT wrote.
For companies looking to screen out bad actors, the US Office of Foreign Assets Control maintains a public database where crypto businesses can check counterparties against updated sanctions lists and watch for patterns tied to IT worker fraud.
Featured image from Unsplash, chart from TradingView
