Drift Loses $280M to 6-Month North Korean Op

Attackers approached Drift contributors while presenting themselves as representatives of a quantitative trading firm.

Crypto hack News

Drift Protocol published a post-mortem on Saturday linking its April 1 exploit to a deliberate intelligence operation that ran for approximately six months before executing. The attack drained roughly $280 million from the Solana-based perpetuals exchange. The team assessed with "medium-high confidence" that the same North Korean state-affiliated group behind the $50 million Radiant Capital hack in October 2024 carried out the operation.

The operation

in or around fall 2025 at a major crypto conference. Attackers approached Drift contributors while presenting themselves as representatives of a quantitative trading firm. A Telegram group was established at that first meeting, and the same individuals continued making contact from that point forward.

The group met Drift contributors face-to-face at industry events across multiple countries through February and March 2026. Their technical fluency and verifiable professional backgrounds made the relationship appear consistent with how legitimate trading firms engage with DeFi protocols. Between December 2025 and January 2026, they onboarded an Ecosystem Vault, completed standard strategy paperwork, and deposited more than $1 million of their own capital into the protocol.