Drift

Solana

DeFi

Million

Read

<p><strong>Attackers drained approximately $285 million from Solana-based Drift Protocol on April 1, 2026, in what blockchain forensics firms describe as a governance compromise operation bearing hallmarks of suspected North Korean tradecraft, not a conventional smart contract exploit.</strong></p>
<p>Drift Protocol confirmed the incident in a post on X, stating that it was experiencing an active attack and had suspended all deposits and withdrawals. The protocol, one of the larger perpetual futures platforms on Solana, went dark within minutes of the first unauthorized transfers.</p>
<h2 id="how-attackers-drained-285-million-in-12-minutes">How Attackers Drained $285 Million in 12 Minutes</h2>
<p>Blockchain intelligence firm TRM Labs said the attackers <a href="https://www.trmlabs.com/resources/blog/north-korean-hackers-attack-drift-protocol-in-285-million-heist" rel="noopener noreferrer nofollow">drained roughly $285 million</a> from Drift in approximately 12 minutes. Most of the stolen funds were bridged to Ethereum within hours of the exploit.</p>
<p>Elliptic, a separate blockchain forensics firm, <a href="https://www.elliptic.co/blog/drift-protocol-exploited-for-286-million-in-suspected-dprk-linked-attack" rel="noopener noreferrer nofollow">estimated the losses at about $286 million</a>, with the discrepancy reflecting differences in asset valuation timing across the two firms. Elliptic identified the largest single stolen transfer as approximately 41.7 million JLP tokens worth roughly $155 million at the time of theft.</p>
<p>The speed of the operation distinguishes it from slower, multi-stage exploits. Drift's immediate suspension of deposits and withdrawals limited further exposure, but the bulk of damage was already done before the shutdown took effect.</p>
<h2 id="why-investigators-point-to-dprk-tradecraft-not-a-code-bug">Why Investigators Point to DPRK Tradecraft, Not a Code Bug</h2>
<p>TRM Labs said the critical failure was not a vulnerability in Drift's smart contracts. Instead, the exploit relied on a combination of social engineering targeting multisig signers, pre-signed durable nonce transactions, and a zero-timelock Security Council migration that allowed the attackers to bypass standard governance delays.</p>
<p>This distinction matters. A smart contract bug implies a flaw in the protocol's code that can be patched. What investigators described here is a governance and signer compromise, a fundamentally different attack surface that raises questions about how DeFi protocols secure their administrative keys and upgrade paths.</p>
<p>Elliptic said the on-chain laundering behavior and network-level indicators were consistent with prior DPRK-linked operations. The rapid cross-chain movement of funds from Solana to Ethereum mirrors patterns seen in earlier incidents attributed to North Korean groups.</p>
<p>However, no public government or law-enforcement attribution confirming DPRK responsibility has been issued. The suspected link remains based on private-sector analysis of behavioral and technical indicators, not official confirmation. Readers following <a href="https://www.kanalcoin.com/japan-stablecoin-rules-explained-psa-jpy-coins-banks/" rel="noopener noreferrer nofollow">evolving regulatory frameworks around digital asset compliance in Japan</a> and other jurisdictions will recognize the difficulty of formal state-level attribution in crypto-related incidents.</p>
<h2 id="drift-s-tvl-collapsed-to-under-8-million">Drift's TVL Collapsed to Under $8 Million</h2>
<p>The impact on Drift's platform standing has been severe. DeFiLlama data shows Drift Trade with approximately <a href="https://defillama.com/protocol/drift-trade" rel="noopener noreferrer nofollow">$7.76 million in total value locked</a> on Solana after the exploit, a catastrophic decline for a protocol that previously held hundreds of millions in user deposits.</p>
<figure><img src="https://www.kanalcoin.com/wp-content/uploads/2026/04/kanalcoin__defillama__protocol-tvl-chart.jpg" alt="DefiLlama protocol tvl chart for Suspected North Korean Operatives Pull Off $285 Million Exploit on Solana based Drift Protocol : A...">
 <figcaption>
  DefiLlama DeFi dashboard used to support the liquidity and protocol-activity discussion for solana.
 </figcaption>
</figure>
<p>The DRIFT token was trading at roughly $0.0473 with a market capitalization of about $27.5 million, according to CoinGecko data. Despite a 6.4% bounce over the prior 24 hours, the token remains under heavy pressure as markets assess whether the protocol can recover user trust.</p>
<p>The incident adds to a difficult period for risk assets broadly. The <a href="https://www.kanalcoin.com/bitcoin-has-stuttered-during-the-iran-war-why-its-now-a-critical-market-indicator/" rel="noopener noreferrer nofollow">broader crypto market has already been navigating geopolitical uncertainty</a>, and the Fear and Greed Index sat at 9, deep in Extreme Fear territory, at the time of the exploit.</p>
<h2 id="compliance-exposure-for-bridges-and-exchanges">Compliance Exposure for Bridges and Exchanges</h2>
<p>If the DPRK attribution holds, the incident carries sanctions-screening implications for every intermediary the stolen funds touched. The U.S. government has previously linked North Korean crypto theft to weapons-program funding, which means exchanges, bridges, and on-ramps that process transactions tied to the stolen addresses face potential compliance exposure.</p>
<p>Elliptic noted that the laundering path, moving assets rapidly from Solana to Ethereum, places particular scrutiny on cross-chain bridge operators. The <a href="https://www.kanalcoin.com/u-s-jobs-report-march-payrolls-rise-178000-unemployment-falls-to-4-3/" rel="noopener noreferrer nofollow">current macroeconomic environment</a> already has regulators focused on financial system integrity, and a nine-figure theft with suspected state-actor involvement is likely to intensify that attention.</p>
<p>Drift has not yet published a full public postmortem. The protocol's initial statement confirmed the attack and service suspension but did not detail the complete exploit mechanics or outline a recovery plan. Until that postmortem arrives, the blockchain forensics reports from TRM Labs and Elliptic remain the most detailed public accounts of how the attack unfolded.</p>
<p>Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.</p><a href="https://www.kanalcoin.com/?p=61291" rel="noopener noreferrer nofollow">Read original article on kanalcoin.com</a>

Drift Protocol Exploit Hits $285M in Suspected DPRK-Linked Attack

Table of Contents

Kanalcoin

Other articles published on Apr 3, 2026

Join our free newsletter for daily crypto updates!