‘Six Months in the Making’: Drift Protocol Says $285,000,000+ Hack Involved North Korean-Backed Impostors at Multiple Crypto Conferences

The recent $285 million hack on the Solana-based DeFi platform Drift Protocol wasn’t any run-of-the-mill exploit.

Drift Protocol says in a new incident update that the April 1st attack was the result of six months of careful manipulation from North Korean-backed impostors.

“In or about Fall 2025, Drift contributors were approached by a group of individuals at a major crypto conference who presented as a quantitative trading firm looking to integrate on the protocol. It is now understood that this appears to be a targeted approach, where individuals from this group continued to deliberately seek out and engage specific Drift contributors, in person, at multiple major industry conferences in multiple countries over the following six months.

They were technically fluent, had verifiable professional backgrounds, and were familiar with how Drift operated. A Telegram group was established upon the first meeting, and what followed were months of substantive conversations around trading strategies and potential vault integrations. These interactions are typical of how trading firms interact and onboard with Drift.”

The impostors onboarded an Ecosystem Vault on Drift in December and January, engaging with multiple contributors in a number of different working sessions and depositing more than $1 milllion worth of their own capital.

“Integration conversations continued through February and March 2026. Various Drift contributors met individuals from this group again, face-to-face, at multiple major industry conferences. By this point, the relationship was nearly half a year old. These were not strangers; they were people Drift contributors had worked with and met in person.

Throughout all of this, links were shared for projects, tools, and apps they claimed to be building, which was standard practice for trading firms.”

Drift Protocol says investigations have concluded with “medium-high confidence” that the attack was orchestrated by the same North Korean-linked criminal group that hacked the DeFi platform Radiant Capital in 2024.

The project notes, however, that none of the individuals they met with in person in the lead-up to the attack were North Korean nationals.

“DPRK threat actors operating at this level are known to deploy third-party intermediaries to conduct face-to-face relationship-building…

The investigation has shown so far that the profiles used in this third party targeted operation had fully constructed identities including employment histories, public-facing credentials and professional networks. The people Drift contributors met in person appeared to have spent months building profiles, both personal and professional, that could withstand scrutiny during a business or counterparty relationship.”

Generated Image: Midjourney