Trending Now - North Korean Operatives Allegedly Breach Major Defi Platforms

WHO:

Bitcoinist - North Korea-connected operatives have been identified as infiltrating crypto companies and DeFi projects.

Cointelegraph - Security researcher Taylor Monahan has reported on the infiltration of DeFi platforms by North Korean IT workers.

WHAT:

Gizmodo - North Korea has relied on cryptocurrency theft as a consistent funding mechanism for years.

Bitcoinist - A $280 million exploit against Drift Protocol occurred on March 31st, 2026, marking the latest operation tied to a network of North Korean agents.

Techmeme - The North Korean attackers stole $270 million by posing as a quant trading firm, which included a deposit of over $1 million and in-person meetings with Drift contributors across multiple countries.

Inc - The North Korean intelligence operation that led to the $285 million theft was described as a legitimate business partnership that lasted six months.

Inc - North Korean operatives stole $285 million in a crypto hack, which was described as a legitimate business partnership that turned into a six-month intelligence operation.

Techmeme - Suspected North Korean attackers stole $270 million by posing as a quant trading firm in a 6+ month operation, which included in-person meetings and a deposit of over $1 million.

Cointelegraph - At least 40 decentralized finance platforms have been infiltrated by North Korean IT workers at some stage of their lives.

Bitcoinist - The infiltration of crypto companies and DeFi projects by North Korean operatives has been described as a long-standing saga.

WHERE:

Cointelegraph - The infiltration has occurred within decentralized finance platforms, which are part of the broader cryptocurrency ecosystem.

WHEN:

Cointelegraph - The infiltration of DeFi platforms by North Korean workers has been ongoing for 7 years, indicating it began around 2019.

WHY:

Bitcoinist - The motivations behind the infiltration are not explicitly stated, but the context suggests a strategic interest by North Korean operatives in the cryptocurrency sector.

HOW:

TechCrunch - North Korean hackers executed a long-running campaign by pushing out malicious updates to a popular open source project after hacking a top developer's computer, indicating the operation was likely weeks in the making.

TechCrunch - North Korean hackers executed a long-running campaign by pushing out malicious updates to a popular open source project after hacking a top developer's computer.

Techmeme - The attackers posed as a trading firm and met Drift contributors in person across multiple countries to facilitate the operation.

Bitcoinist - North Korean operatives have reportedly spent years embedding themselves within crypto companies and DeFi projects, indicating a methodical approach to infiltration.

(UPDATED April 7, 2026 11:15 UTC)

North Korea has been using cryptocurrency theft as a steady source of funding for years, with a recent $280 million exploit against Drift Protocol on Tuesday, highlighting their ongoing operations. This attack was carried out by North Korean hackers who executed a long-running campaign by pushing out malicious updates to a popular open source project after compromising a top developer's computer. The sophistication of this operation suggests it was likely in the works for several weeks.

(UPDATED April 7, 2026 09:16 UTC)

North Korean hackers have successfully stolen $270 million by masquerading as a quant trading firm, engaging in in-person meetings with contributors from Drift across various countries. This intelligence operation, which lasted six months, was framed as a legitimate business partnership and ultimately led to a total theft of $285 million. The hackers executed their scheme by pushing out malicious updates to a popular open source project after compromising a top developer's computer, suggesting that the operation was meticulously planned over several weeks.

(UPDATED April 6, 2026 23:07 UTC)

North Korean operatives have stolen $285 million in a crypto hack, which was initially framed as a legitimate business partnership but evolved into a six-month intelligence operation. The hackers executed this long-running campaign by pushing out malicious updates to a popular open source project after gaining access to a top developer's computer. This sophisticated operation highlights the ongoing cyber threats posed by North Korea in the digital landscape.

(UPDATED April 6, 2026 17:12 UTC)

Suspected North Korean attackers have reportedly stolen $270 million by posing as a quantitative trading firm in a sophisticated operation that lasted over six months. The attackers engaged in in-person meetings with contributors from Drift across multiple countries to carry out their scheme. This elaborate ruse included a significant deposit of over $1 million to further their deception.

(UPDATED April 6, 2026 15:14 UTC)

North Korean operatives have been identified as infiltrating decentralized finance platforms, with reports indicating that at least 40 of these projects have been affected over the past seven years. Security researcher Taylor Monahan highlighted that this infiltration has been a long-standing saga, suggesting a strategic interest by North Korea in the cryptocurrency sector. The operatives have reportedly spent years embedding themselves within these companies, indicating a methodical approach to their infiltration efforts.