North Korean Hackers Spent 6 Months Inside Drift Before $285M Heist

Cybersecurity firms have attributed the largest DeFi hack of 2026 to North Korean state-sponsored actors. On April 1, 2026, attackers drained approximately $285 million (estimates range $270M–$286M) from Drift Protocol, Solana’s leading decentralized perpetual futures exchange.

The exploit unfolded rapidly — most funds were siphoned in roughly 12 minutes — with attackers emptying multiple vaults before bridging the majority to Ethereum via CCTP within hours. They swapped assets into USDC and ETH, then laundered through complex chains of transactions.

Sophisticated Six-Month Operation
Recent updates from Drift and blockchain analytics firms reveal the attack was not a simple smart contract exploit. A North Korean-linked group reportedly spent roughly six months infiltrating the project. They posed as a quantitative trading firm, built relationships with contributors (including in-person meetings across countries), deposited their own capital, and used advanced social engineering tactics. This included abusing governance mechanisms, durable nonces, pre-signed transactions, and unauthorized approvals to seize control of the Security Council’s administrative powers.

Firms such as Elliptic, TRM Labs, and others identified multiple indicators — on-chain behavior, laundering patterns, and network signals — consistent with previous operations by North Korea’s Lazarus Group (also known as TraderTraitor). This marks the 18th such attack tracked by Elliptic in 2026 alone, with DPRK-linked actors stealing over $300 million so far this year.

Broader Context and Implications
North Korea has emerged as one of the most prolific crypto thieves globally, with stolen funds allegedly supporting its weapons and military programs. The group previously executed massive hacks, including the $1.5 billion Bybit exploit and the Ronin Bridge incident.

The Drift breach highlights critical vulnerabilities in DeFi governance and multisig setups. Even without direct code exploits, sophisticated social engineering and insider-style access can bypass protections.

Implications for the industry:
– DeFi platforms must strengthen governance, conduct regular security audits, and implement continuous monitoring.
– Users should practice self-custody where possible and diversify across protocols.
– Regulators are likely to intensify scrutiny on permissionless finance.

Drift has suspended operations temporarily, pledged a full post-mortem, and even messaged attacker wallets on Ethereum stating “We are ready to speak.” Most funds remain unrecovered.

This incident serves as a stark reminder that state-backed actors continue to target the crypto ecosystem with increasing sophistication, blending technical exploits with human intelligence operations.