Drift Protocol - Rekt · 4/1/2025
Excerpt: DPRK hackers spent 6 months sending proxies to befriend Drift Protocol. Conferences, trust, $1 million deposited. $285 million later, those friends vanished. No code broken. No bug found. Just a six-month con, a fake token, and a culture that never saw it coming. | Article date: 4/9/2026
Drift Protocol exploit; stolen assets swapped into USDC and bridged to Ethereum (alleged in suit by Kim judgment creditors against Circle) · April 1, 2026 (approach to Drift contributors in or about Fall 2025)
At 18:49 UTC on April 1, 2026, @lookonchain commented that "[t]he Drift Protocol exploiter is swapping the $270M+ stolen assets into $USDC, then bridging to #Ethereum to buy $ETH." ... "Mandiant's investigation [already] conclusively attributed the attack to UNC6862, a North Korean threat group with direct ties to other state-sponsored actors involved in similar attacks on other platforms." [Case No. 1:26-cv-05445, U.S. District Court for the Southern District of New York; filing: COMPLAINT against Circle Internet Financial LLC, Circle Internet Group, Inc..]
Drift Protocol exploit (Solana perpetual futures exchange) · Apr 2, 2026 (updated 7 April, 2026; incident April 1, 2026)
Elliptic has identified multiple indicators suggesting that the exploit of Drift Protocol is linked to the Democratic People's Republic of Korea (DPRK). ... This incident represents the eighteenth DPRK-linked act Elliptic has tracked this year, with over $300 million stolen so far.
Drift Protocol hack · published 2026-04-09 (April 1, 2026)
On April 1, 2026, Solana's Drift Protocol was drained of $285 million (over 50% of its TVL) in a highly coordinated attack likely linked to North Korean (DPRK) actors.
Drift Protocol hack · published 2026-04-03 (April 1, 2026)
TRM's initial investigation suggests the hack was likely perpetrated by North Korean hackers.