The latest analysis conducted by blockchain analytics firm Elliptic suggested that entities linked to the Democratic People's Republic of Korea may be behind the Drift protocol breach.
The report indicated that the hacker focused on three main vaults. This included GLB Delta Neutral, Super Staking Sol, and Super Staking BTC.
Note that the wallet used in the attack was set up about eight days before the incident, and it received a small test transaction from one of the Drift vaults, indicating a carefully planned operation.
The stolen assets were then swapped to USDC and linked across chains from Solana to Ethereum.
Elliptic's report stated that on-chain behavior, money laundering methodologies, and network-level indicators linked to the attack correspond with techniques observed in previous operations attributed to the Democratic People's Republic of Korea.
TRM Labs' investigations also indicated hackers from North Korea, highlighting several signals that align with tactics typically associated with North Korean operations.
TRM Labs' investigation stated that the use of Tornado Cash in the initial phase, the timing of the Carbon Foot token release at 09:30 AM Pyongyang time, cross-chain linking patterns, and the speed and volume in money laundering after the hack—all closely correspond with methods previously observed in hacks attributed to the Democratic People's Republic of Korea, including the BitPay hack in 2025.
The April 1 attack on the perpetual contracts platform built on Solana (sol) ranked as the largest hack of decentralized finance (DeFi) in 2026. Its repercussions are still unfolding, with reports indicating that the number of affected projects has now jumped to 20.
Follow us on X for the latest news as it happens
If confirmed, this incident will mark the 18th operation linked to the Democratic People's Republic of Korea detected by Elliptic in 2026, with total losses for this year exceeding $300 million. According to Elliptic, they stole over $6.5 billion in digital assets in recent years.
Chainalysis reported that North Korean hackers stole a record $2.02 billion in 2025 alone, a 51% increase year-on-year, primarily due to the BitPay hack amounting to $1.5 billion.