Drift Protocol believes the recent $280+ million exploit was the culmination of a prolonged, meticulously planned operation that involved establishing “an active operational presence within the Drift environment.”

On April 1st, the trading platform on Solana noticed unusual activity, later confirming that funds were stolen through a sophisticated attack that allowed them to seize control of administrative functions.

Blockchain analysis firms Elliptic and TRM Labs have attributed the theft to North Korean hackers, who reportedly took around 12 minutes to extract user funds.

The investigation revealed that the hackers had been preparing the attack for at least half a year, pretending to be a quantitative trading firm and personally contacting Drift team members at various crypto events.

“It’s now understood that this appears to be a targeted approach, where individuals from this group continued to actively seek out and engage specific Drift team members, in person, at several major industry conferences in multiple countries over the following six months,” Drift Protocol stated.

The attacker continued to communicate with their targets through Telegram, discussing trading tactics and possible integrations. They were technically skilled and showed understanding of Drift’s workings, engaging in conversations similar to onboarding exchanges between trading firms and the platform.

Drift says the Telegram group used to communicate with contributors was deleted immediately after the theft.

The platform has not definitively determined how the attack occurred, but suspects that two contributors were compromised in the following ways:

• A malicious code repository shared with a contributor, potentially taking advantage of a VSCode/Cursor weakness allowing hidden code execution.
• A fake TestFlight application disguised as a wallet.

Various indicators found in Elliptic’s and TRM Labs’ investigations suggest a North Korean attacker. Drift’s conclusions also indicate with reasonable confidence that the attack was conducted by UNC4736 (also known as AppleJeus and Labyrinth Chollima), a threat actor linked to North Korea by multiple security firms.

Incident response firm Mandiant has previously linked UNC4736 to Lazarus. The same group is responsible for the 3CX supply-chain compromise in 2023, the $50 million Radiant cryptocurrency theft in 2024, and has also been associated with Chrome zero-day exploitation.

However, it’s noted that the individuals who met with Drift contributors at conferences were not Korean, but rather intermediaries.

Currently, all Drift Protocol functions are suspended, and the compromised wallets have been removed from the multi-signature process.

Drift reports that the attackers’ wallets have been flagged across exchanges and bridge operators to prevent the actor from moving or withdrawing the stolen funds.