Bankless
Bankless

Why North Korea Is Winning Crypto Crime and How to Fight Back | Ari Redbord, TRM Labs

May 11, 2026

AI Summary

5 min read

North Korea has professionalized crypto theft to the point where it now accounts for the vast majority of DeFi hacks, and its methods have evolved from targeting technology to targeting people. In April, North Korean hackers drained $285 million from the Solana-based protocol Drift in just 12 minutes, and that single hack, combined with the Kelp DAO attack, accounted for 76% of all hack value in the first four months of 2026. The Drift hack was especially chilling because it involved months of in-person social engineering—proxies met Drift team members at conferences, formed fake partnerships, and even made a significant investment in the project before gaining access to private keys.

State Actors, Not State-Sponsored

Continue reading the full summary in the app — free to try.

Read Full Summary →

Free • No credit card required

What you'll learn

  • 1 Why North Korea Is Winning Crypto Crime and How to Fight Back | Ari Redbord, TRM Labs
  • 2 (00:00) **North Korea: State Actors, Not State-Sponsored** - Ari Redbord rejects the term "state-sponsored" for North Korea's hacking; these are direct state actors with no economy who have professionalized cybercrime
  • 3 (02:23) **The Drift Hack: $285 Million Drained in 12 Minutes** - North Korea's Lazarus group stole $285M from Drift protocol on April 1st, representing 76% of all 2026 hack value from just two targets
  • 4 (07:37) **Social Engineering to Technical Breach** - The social engineering phase directly enabled the technical attack on Drift's validator system
  • 5 (11:55) **The North Korean Hacker Ecosystem** - A lay of the land for Lazarus Group, Bureau 121, and other subgroups operating under the North Korean government
  • 6 (16:15) **$6 Billion Stolen: What Happens Next** - North Korea has stolen approximately $6 billion over five years, and they need to launder it fast to fund weapons research and the regime
  • 7 (21:58) **National Security's View on Crypto** - The US national security community wants to stop North Korea, not shut down DeFi or crypto entirely

+ Full timestamped outline available in the app

Show Notes

North Korea isn’t just hacking crypto anymore, it’s studying it, infiltrating it, and turning DeFi’s weakest links into a state-run revenue machine. This time around, Ryan and David sit down with Ari Redbord of TRM Labs to unpack the Drift hack, the $6B DPRK crypto crime machine, how stolen funds move through THORChain, Bitcoin, OTC desks, and Chinese laundering networks, and why the fightback may require everything from better DeFi security to real-time Beacon alerts and offensive cyber.

---
🎬 DEBRIEF | RYAN & DAVID BREAKDOWN THE EPISODE
https://www.bankless.com/podcast/debrief-why-north-korea-is-winning-crypto-crime-and-how-to-fight-back-ari-redbord-trm-labs

---
BANKLESS SPONSOR TOOLS:


🔮POLYMARKET | #1 PREDICTION MARKET
https://bankless.cc/polymarket-podcast

🟦 COINBASE ONE | GET 20% OFF
https://bankless.cc/coinbase-one

🧭OKX | TRADE, EARN, PAY to OKX | 120M+ USERS WORLDWIDE
https://app.okx.com/join/USBANKLESS

🦊 METAMASK | DOWNLOAD NOW
https://go.metamask.io/BL-Pod-Download

🌐BRIX | EMERGING MARKET YIELD
https://bankless.cc/brix

💰NEXO | Get your 30-day access to Wealth Club Premier
https://bankless.cc/nexo

---
TIMESTAMPS

0:00 Intro
2:16 The Drift Hack
5:15 Human Weak Points
11:16 The DPRK Hacker Network
14:56 The $6B Machine
20:32 Fighting Back
28:11 Seizures and Victims
38:58 Inside TRM Labs
47:01 Laundering Rails
52:51 The Beacon Network
58:06 Privacy vs Security
1:10:20 Code and Crime
1:14:49 Iran on Tron
1:22:55 Bitcoin and Power
1:28:49 Hardening DeFi

---
RESOURCES

Ari Redbord
https://x.com/ARedbord

TRM Labs
https://www.trmlabs.com/

TRM’s DPRK Report
https://www.trmlabs.com/r

Bankless