Decentralized finance, or DeFi, comprises blockchain-based protocols for activities such as trading, lending, staking, and cross-chain asset transfers. DPRK-linked operators have targeted this ecosystem through social engineering and compromises of developers, credentials, signing systems, keys, and off-chain verification infrastructure, often bypassing audited smart contracts to steal assets or create downstream losses across connected protocols.