How state-sponsored attackers bypass everything your audit checks.
Drift lost $285 million. Bybit lost $1.5 billion. Same group. You know the stories.
What most teams haven't worked out is what to actually change.
DPRK went to conferences, built relationships, deposited capital, and waited. Six months later, they moved. By then, the people they were targeting had shaken hands with them across multiple continents. The relationship felt real because it was designed to.
Your contracts can be perfectly audited and this could still happen to you. The gap is operational and most DeFi teams have not closed it.
Vetting Counterparties
A trading firm wants to integrate. Standard request. Hundreds of protocols handle this every month.
"Legitimate trading firm" is now a role state-sponsored actors play well:
- Real on-chain history
- Detailed strategy conversations
- Capital deployed into your protocol
- Months of behaving exactly as expected
Drift followed this pattern. The relationship was real. The compromise didn't come from access abuse. It came from a repo shared during a normal workflow. The compromise happened inside a trusted relationship.
What you can control is what they are allowed to do to your systems:
Before granting access
- Verify the firm exists beyond its website
- Independently research the founders and team members
- Check on-chain history of every wallet
- Treat all integration requests with baseline skepticism
Once access is granted
- Never clone repos or run code on your primary machine
- Use isolated environments every time
- Separate development from signing
- No signing keys on development devices
- Use dedicated hardware for signing
Operational controls
- Minimum permissions only
- Time-limited access
- Scheduled access audits
- Same-day offboarding
Verifying People
DPRK operatives have been contributing to DeFi protocols since DeFi Summer. Researchers have identified 40+ major protocols that employed them at some point.
Before the interview
- Cross-check work history directly
- Contact previous employers through independent channels
- Review GitHub history for inconsistencies
- Run emails and handles through breach databases
During the interview
- Watch for deepfake behavior
- Ask candidates to perform simple real-time verification (turn sideways, hold ID)
- Verify where the work device actually is
- Watch for shipping address mismatches
- Flag installation of remote admin or screen-sharing tools early
- Require hardware-based MFA for all access
The Kim Jong-un test: Some teams have started asking candidates to say something critical about North Korean leadership on the call. Operatives will not do it regardless of how deep the cover story runs.
First 30 days
- Read-only access only
- No production or multisig access
- Document all permissions
- Watch for repeated access requests
Offboarding
- Same-day revocation
- Rotate all secrets
- Review commit history
Conference Opsec
Conference floors are where these relationships start. Your vetting process is built for known threat models. A six-month in-person relationship sits outside that model entirely.
- Never demo on your main machine at side events
- Never screen-share a device with protocol access or multisig credentials
- Use your phone as a hotspot, never connect to conference WiFi on a work device
- Be skeptical of persistent follow-up from people you met once
- If someone from a side event sends you a repo, a link, or an app to try: isolated environment or don't open it
Device and Signing Hygiene
Two normal actions caused compromise: Cloning a repo and installing a "TestFlight" wallet app.
- Never clone a repo from a counterparty on your main machine. Disposable VM, every time.
- Never download apps or tools sent by external teams regardless of relationship length.
- Keep your editors updated. A patch that exists but wasn't applied is not protection.
On signing: Blind signing is how nine-figure losses happen (ByBit). Malicious JavaScript injected into a trusted interface shows you a legitimate transaction while executing a different one.
- Always verify transactions independently
- Use separate tools or devices
- Use hardware keys for all critical access
- Rotate sessions immediately after offboarding
- Audit browser extensions across the team
Access Control and Protocol Design
With admin access compromised, the protocol was drained in twelve minutes.
Part of what made that possible: a 2/5 multisig with no timeouts, and durable nonces that allowed transactions to be pre-signed and held.
A more responsible setup:
- Mandatory execution delay between a transaction being fully signed and it going through
- Restrictions on durable nonces for high-value operations
- A separate cancellation key that can veto any queued transaction during the delay window
Beyond the multisig configuration: Adding power should be slow. Removing power should be fast.
- Timelocks on admin transfers
- Separate your pause function from your resume function
- A circuit breaker: a global emergency stop any guardian can trigger immediately
- Multiple admin roles with narrow, documented permissions
Supply Chain
A $1.5 billion loss started at a developer's workstation compromised days earlier.
Key practices
- Audit all dependencies
- Verify frontend integrity
- Understand where code is loaded from
DPRK runs this in reverse too. They set up fake crypto companies and post real jobs. Developers apply, go through a technical interview, and get compromised during the coding assessment. Confirmed front companies: BlockNovas LLC, Angeloper Agency, SoftGlide LLC. If a company asks you to clone and run a repo as part of a technical screen, that is a known attack pattern. Isolated environment, every time.
What You're Already Leaking
Before anyone approaches your team, they have already studied you.
Your Telegram group. Your Notion workspace. Your Discord with an "internal" channel that is not actually restricted. Your team's LinkedIn profiles listing every tool you use, every protocol you have worked on, and where your contributors will be next month.
All of it is an intelligence feed for anyone patient enough to read it. Audit what you expose before someone else does it for you.