Drift Protocol attributed with “medium-high confidence” the $285 million hack to UNC4736, a group affiliated with the North Korean state. The attackers spent six months infiltrating the protocol: they attended conferences, deposited $1 million, and erased all traces after executing the exploit.
Drift Protocol published a post-mortem revealing its $285 million exploit was a structured intelligence operation by suspected North Korean state-linked actors using fake identities and in-person meetings.
The largest DeFi hack this year took place last week on April 1 as Drift Protocol, one of the largest perp DEXs on the solana network, experienced an exploit that saw roughly $286 million vanish from the protocol. The attack was tied to North Korean-linked hackers and the entire hack transpired in just 10 seconds.
Drift Protocol said the attackers posed as traders, met contributors in person, and spent months infiltrating before draining the platform.
Crypto attorney Ariel Givner criticizes Drift Protocol for civil negligence.
Drift's $285M exploit exposed a control-layer takeover, shifting DeFi security concerns from code bugs to signer, admin, and governance risks.
Drift's exploit shows control-layer attacks rising, where response speed now defines DeFi security and trust.
Drift Protocol has revealed details surrounding a devastating $280 million exploit that occurred on April 1, 2026, exposing a sophisticated, long-running cyberattack linked to North Korean state-sponsored hackers. The decentralized exchange confirmed the breach involved months of calculated social engineering, malicious software distribution, and deep trust-building tactics before any funds were touched.
Attorney Ariel Givner says Drift's $280M exploit may qualify as civil negligence if the protocol skipped basic security safeguards.
The $280 million Drift Protocol attack was likely carried out by threat actors aligned with North Korea state-affiliated hackers.
While the world watched the news from the Middle East, a silent and surgical strike was executed on the Solana blockchain.
With "medium-high" confidence, Drift and the SEAL 911 team assess the operation was run by the same North Korean actors behind the Radiant Capital hack.