Update: The article and its title have been updated to reflect new evidence suggesting North Korean hackers were behind the breach.

Drift Protocol suffered a loss of at least $280 million due to a planned and elaborate attack where a malicious actor gained control of the platform’s Security Council administrative privileges.

Blockchain analysis companies Elliptic and TRM Labs believe the attack was carried out by North Korean hackers, citing various on-chain activities consistent with North Korea’s hacking methods.

These methods include using Tornado Cash, timing CarbonVote deployments at 9:30 AM Pyongyang time, employing specific cross-chain transfer patterns, and rapidly laundering large sums of money, similar to the Bybit hack.

The attacker utilized durable nonce accounts and pre-authorized transactions, allowing them to postpone the attack and execute it precisely when desired, according to the platform.

Drift emphasizes that the breach did not exploit any vulnerabilities in its code or smart contracts, and user seed phrases remain secure.

Drift Protocol is a decentralized finance (DeFi) trading platform on the Solana blockchain, operating as a non-custodial exchange that gives users complete ownership of their funds while trading on-chain.

As of late 2024, the platform reported having 200,000 traders, with over $55 billion in total trading volume and a daily peak of $13 million.

According to Drift’s statement, the attack was planned between March 23rd and 30th, with the attacker establishing durable nonce accounts and securing 2 out of 5 multisig approvals from Security Council members to reach the necessary threshold.

This allowed the attacker to create malicious transactions in advance, which were not immediately processed.

On April 1st, the attacker executed a valid transaction and then immediately triggered the pre-signed malicious transactions, quickly transferring administrative control to their account within minutes.

After gaining administrative control, the attacker introduced a fraudulent asset, removed withdrawal limits, and ultimately drained the funds.

Drift Protocol estimates the losses to be approximately $280 million, while the blockchain analytics firm PeckShieldAlert has calculated the losses at $285 million.

Upon noticing suspicious activity on the protocol, Drift publicly alerted users, stating they had launched an investigation and advising them to refrain from depositing funds until further notice.

The attack has affected borrow/lend deposits, vault deposits, and trading funds, effectively halting all protocol operations. Drift stated that DSOL remains unaffected, and insurance fund assets are secure.

The platform is collaborating with security firms, cryptocurrency exchanges, and law enforcement agencies to track down and freeze the misappropriated funds.

Drift has committed to publishing a comprehensive post-incident report in the coming days.