driftprotocol

🇰🇵North Korean-linked group Lazarus Group continues to dominate crypto exploits — total damage now exceeds $3B.

Key attacks:

🔸 2017 — Bithumb ($7M, phishing)
🔸 2018 — Coincheck ($625M, malware)
🔸 2020 — KuCoin ($280M, stolen credentials)
🔸 2022 — Ronin Network ($625M, fake job offer)
🔸 2022 — Horizon Bridge ($100M, private key exploit)
🔸 2023 — Atomic Wallet / Alphapo / CoinsPaid / Stake / CoinEx ($292M total)
🔸 2024 — WazirX ($235M, multisig breach)
🔸 2025 — Bybit ($1.5B, multisig)
🔸 2026 — Drift Protocol ($285M, fake collateral)

From phishing to multisig exploits — tactics evolve, but the result is the same. 🤷

Crypto security isn’t improving as fast as attackers are.

#LazarusGroup #NorthKoreaHackers #DriftProtocol

The story of how North Korean state hackers drained $285 million from Drift Protocol on April Fool's Day 2026 doesn't begin with a line of malicious code. It begins at a crypto conference sometime in the fall of 2025, with a handshake.
That's the detail that makes this the most unsettling DeFi hack of the year and possibly the most sophisticated social engineering operation in crypto history. The attackers, attributed with medium-high confidence to a North Korean state group known as UNC4736 (also called AppleJeus or Citrine Sleet), didn't brute-force their way in. They spent six months building genuine human relationships inside Drift's team.
The playbook was meticulous. Posing as a legitimate quantitative trading firm, they approached Drift contributors at multiple major industry conferences in different countries throughout late 2025 and early 2026. They were technically fluent. They asked smart questions about trading strategies and protocol architecture. They deposited over $1 million of their own money to establish credibility. A Telegram group was set up, meetings happened in person, and over months of substantive conversations, they became from Drift's perspective trusted working partners.
Then came the quiet infection. Investigators identified two likely attack vectors: one contributor may have cloned a malicious code repository the group shared, disguised as a frontend tool for their vault. Another was reportedly tricked into downloading a wallet app through Apple's TestFlight a tool that, ironically, was also used to remove Bitchat from China this week. Simply opening a file in a VS Code folder was enough to silently execute code and give the attackers remote access. No warning. No prompt. Just a compromised device.
On April 1, using pre-signed multisig transactions that had been sitting dormant for over a week, the attackers executed the drain in roughly 12 minutes. $285 million gone. Most of it was bridged to Ethereum within hours. The DRIFT token collapsed over 40%. The Telegram group and all associated malware were immediately scrubbed. The "trading firm" vanished.
Security experts are blunt about what this means: DeFi's reliance on multisig governance, long considered a gold standard of security, may not be enough when the adversary is willing to spend six months and a million dollars becoming your colleague first. "Crypto teams are now facing adversaries that operate more like intelligence units than hackers," noted one blockchain security firm. It's an uncomfortable reality but one the industry needs to reckon with.
#DriftProtocol #northkorea #DeFiHack #CryptoSecurity

#DriftInvestigationLinksRecentAttackToNorthKoreanHackers
In a chilling revelation for the Decentralized Finance (DeFi) sector, Drift Protocol, the leading perpetual futures DEX on Solana, has released its final forensic report regarding the catastrophic breach that occurred on April 1, 2026. The investigation, conducted in collaboration with blockchain security titans TRM Labs and Chainalysis, points with "high confidence" toward state-sponsored cyber-adversaries from North Korea (DPRK).
The Anatomy of the Exploit: A 6-Month "Long Game"
The theft of $285 million was not a simple code exploit; it was the culmination of a sophisticated, multi-stage intelligence operation that began in late 2025.
* Corporate Infiltration: The attackers posed as a legitimate high-frequency trading firm, engaging with Drift’s core contributors at global Web3 conferences to build rapport.
* Social Engineering & Multisig Compromise: By building trust over months, the hackers tricked members of the "Protocol Security Council" into interacting with a malicious "administrative dashboard." This allowed the attackers to harvest pre-signed authorizations for critical administrative functions.
* Oracle Manipulation: The hackers deployed a "ghost token" called CarbonVote (CVT). Through wash trading, they artificially inflated its market cap, deceiving the protocol’s oracles into recognizing it as high-value collateral. This allowed them to borrow and drain real assets, including USDC and JLP, against the worthless CVT.
The North Korean Connection
Security analysts identified several hallmarks of Lazarus Group (or its sub-units like UNC4736) in the attack’s execution:
* On-Chain Fingerprints: Wallet clusters used to test the exploit were directly linked to funds from the 2024 Radiant Capital hack and the 2025 cross-chain bridge exploits attributed to the DPRK.
* Automated Precision: The final drain of 5 separate liquidity vaults occurred in under 10 seconds, suggesting the use of a custom-built automated exploit kit characteristic of state-sponsored actors.
* The Laundering Path: Within minutes of the hack, the funds were funneled through sophisticated cross-chain bridges into Ethereum, where they were fragmented into thousands of wallets to evade centralized exchange (CEX) blacklists.
Impact on Solana and the DeFi Ecosystem
This incident marks the largest DeFi hack of 2026 and the second-largest in Solana's history. The DRIFT token plummeted over 40% following the news. Beyond the financial loss, the attack highlights a terrifying shift in tactics: hackers are no longer just looking for bugs in the code; they are hunting the human layer of governance.
Key Takeaways for the Community
* Beyond the Audit: A "Triple-A" code audit cannot protect a protocol if the humans holding the keys are compromised via social engineering.
* Collateral Risk: Protocols must implement stricter "circuit breakers" for new or low-liquidity assets being used as collateral.
* Real-World Vigilance: The transition from digital phishing to in-person social engineering at conferences marks a dangerous new era for crypto founders.
Drift Protocol has announced a bounty of $20 million for the return of the funds, though history suggests that once funds enter the DPRK's laundering pipeline, recovery becomes a monumental challenge.
#DriftProtocol #DeFiSecurity #BinanceSquare #CryptoNews
$BNB
$BTC
$USDC