Drift Protocol

Summary

Drift Protocol suffered a breach in which attackers drained approximately $285 million worth of digital assets after a prolonged social engineering campaign that compromised private keys linked to its multisig approval system. The attackers created counterfeit tokens, inflated borrowing limits, and executed rapid withdrawals before moving the stolen funds across chains to obscure the trail. Investigators linked the operation to a North Korean‑backed group that used fabricated identities and remote collaboration over several months to gain trust and access to developer environments. The incident highlighted vulnerabilities in key management and operational security rather than flaws in the protocol’s smart contract code.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In mid‑March 2026 attackers began preparing for the Drift Protocol exploit by moving funds through the Tornado Cash mixing service to obscure their trail and establishing special accounts for advance transaction setup. On March 27 the Drift security team altered its approval mechanism, reducing the required signatures from five key holders to two out of five and eliminating any built‑in waiting period that could have triggered an alert. Taking advantage of this change, the attackers created 750 million newly minted fake tokens designated CarbonVote Token (CVT) and manipulated the platform’s price‑checking mechanisms so that these worthless assets were treated as legitimate, high‑value collateral capable of backing large withdrawals. On April 1 they executed the pre‑staged transactions, adding the fake token to the protocol, inflating borrowing limits, flooding the system with hundreds of millions of CVT tokens, and draining real assets through 31 rapid withdrawals that unfolded in roughly twelve minutes. The stolen funds were swiftly converted to USDC on a Solana‑based exchange and then bridged to the Ethereum network to hinder traceability.

The operation was rooted in a six‑month social engineering campaign that commenced in fall 2025 when individuals posing as representatives of a quantitative trading firm approached Drift contributors at a major cryptocurrency conference. These actors continued in‑person meetings across multiple countries, formed a Telegram group, discussed detailed trading strategies and vault integrations, and even onboarded an Ecosystem Vault holding over $1 million in deposits, all of which appeared routine to the Drift team. After the April 1 breach the group erased their Telegram history and associated software. Forensic analysis identified three possible vectors for private‑key compromise: a contributor may have cloned a code repository exploiting a known VSCode or Cursor vulnerability to run arbitrary code silently; a second contributor might have been persuaded to download a TestFlight app masquerading as the firm’s wallet product; a third vector remained under active law‑enforcement review. With medium‑to‑high confidence the SEAL 911 team linked the activity to the same North Korean state‑affiliated actors responsible for the October 2024 Radiant Capital hack, noting that the individuals involved in the face‑to‑face interactions were third‑party intermediaries rather than North Korean nationals, a tactic consistent with DPRK tradecraft.

The exploit extracted approximately $285 million from Drift’s storage pools, which held stablecoins such as USDC alongside JLP, SOL and other crypto assets, prompting the protocol to suspend all services on April 2, 2026. Blockchain analysts at TRM Labs and Elliptic traced the on‑chain activity, observing timing aligned with Pyongyang local time and behavioral patterns matching prior DPRK‑linked operations. The incident was characterized as a failure of operational and infrastructure security rather than a smart‑contract vulnerability, with attackers gaining privileged signing access through compromised keys and then manipulating collateralization mechanics to siphon funds. Drift’s public update outlined the timeline, the social engineering approach, and the forensic findings, while noting that the investigation into the exact key‑compromise method continued. The suspension of services marked the immediate response action taken by the Drift team following the theft.

Sources

Sources available to members: 6 sources.