Drift Exploit $285M

Drift protocol reported unusual activity and warned users not to deposit, later confirming active attack and suspension.

Threat researcher says admin signer private key likely compromised, leading to exploit.

Compromised admin key allowed unrestricted control to alter risk parameters, create fake markets, and drain funds.

Elliptic identifies on-chain laundering patterns consistent with North Korean state-sponsored hacking groups.

The exploit was detected when the attacker used pre-signed durable nonce transactions to seize control of the protocol, leading to significant fund outflows.

Two of five council members mis-signed what they believed were routine transactions, allowing attacker to execute a protocol takeover weeks later.

Attacker gained admin powers via social engineering and introduced a fake token to manipulate withdrawal limits.

Attacker bridged stolen USDC via CCTP, and Circle cited lack of legal authorization to freeze.

Exploit occurred on April 1, 2026 after attackers gained trust through in-person meetings and deployed malware.

Drift published a detailed update revealing a six‑month intelligence operation by North Korean group UNC4736 that led to the $270 million exploit.

Attackers built trust over six months, then sent malicious links to compromise developer devices tied to multisig controls.

Bad actors used social engineering and a fake token to drain vaults across 31 withdrawals in 12 minutes.

North Korean hackers posed as a quant firm and socially engineered Drift team members at conferences.

Exploit detected with on-chain evidence of malicious pre-signed transactions affecting multiple Solana protocols.

Suspicious large transfers from the Drift Vault to address HkGz4K, followed by distribution to other wallets, indicated an active exploit.