North Koreans hackers likely behind $286 million Drift Protocol exploit: Elliptic

Finance Share Share this article Copy link X icon X (Twitter) LinkedIn Facebook Email North Koreans hackers likely behind $286 million Drift Protocol exploit: Elliptic The blockchain analytics firm pointed to cross-chain laundering patterns and Solana-specific tracing challenges that mirror prior North Korean state-linked operations By Olivier Acuna | Edited by Stephen Alpher Apr 2, 2026, 2:50 p.m. Make preferred on If confirmed, the $286 million siphoned from the Drift Protocol will likely fund North Korea's weapons of mass destructions programs. North Korea Missiles (Stefan Krasowski-Wikimedia Commons/Modified by CoinDesk) What to know : Blockchain analytics firm Elliptic says the $285 million exploit of Solana-based Drift Protocol shows multiple hallmarks of North Korean state-sponsored DPRK hackers. Elliptic’s analysis points to premeditated, carefully staged on-chain behavior and a structured, cross-chain laundering flow that mirrors past DPRK-linked crypto thefts. The case underscores how Solana’s fragmented account model and increasingly cross-chain laundering tactics complicate investigations, making entity-level clustering and holistic tracing tools essential. Elliptic said Thursday the $285 million Drift Protocol exploit, the largest this year, carries “multiple indicators” of North Korea’s state-sponsored DPRK hacker group involvement. The research firm pointed specifically to onchain behavior, laundering methodologies and network-level signals, all aligning with previous state-linked attacks. Drift Protocol, whose token has dropped over 40% to roughly $0.06 since the hack, is the largest decentralized perpetual futures exchange on the Solana blockchain. “If confirmed, this incident would represent the eighteenth DPRK act Elliptic has tracked this year, with over $300 million stolen so far,” the report said. “It is a continuation of the DPRK’s sustained campaign of large-scale cryptoasset theft, which the U.S. government has linked to the funding of its weapons programs. DPRK-linked actors are believed to be responsible for billions of dollars in cryptoasset theft in recent years,” Elliptic added. Hours earlier, Arkham data showed that over $250 million had been moved from Drift to an interim wallet, then to various other addresses. In December, a Chainalysis report revealed DPRK hackers stole a record $2 billion of crypto in 2025, including the $1.4 billion Bybit breach, representing a 51% increase from the previous year. The U.S. Treasury Department last month said North Korea uses the stolen assets to fund the country’s weapons of mass destruction program. Rather than focusing on the exploit itself, Elliptic’s analysis highlights a familiar operational pattern. The activity appears “premeditated and carefully staged,” with early test transactions and pre-positioned wallets preceding the main event. The report explains that once executed, funds were rapidly consolidated and swapped, bridged across chains, and converted into more liquid assets, reflecting a structured, repeatable laundering flow designed to obscure origin while maintaining control. A central challenge, Elliptic notes, is Solana’s account model. Because each asset is held in a separate token account, activity tied to a single actor can appear fragmented across multiple addresses. Without linking these, investigators risk seeing “fragments of the attacker’s activity, not the complete picture.” This is where Elliptic’s report highlights the clustering approach, which connects token accounts back to a single entity, allowing exposure to be identified regardless of which address is screened. In an incident involving more than a dozen asset types, that entity-level view becomes critical. The case also emphasizes, Elliptic adds in its report, how laundering has become inherently cross-chain. Funds moved from Solana to Ethereum and beyond, demonstrating the need for what Elliptic described as “holistic cross-chain tracing capabilities.” Hack More For You Encryption Supremacy: Zcash and Privacy in the Age of Scale By CoinDesk Research Mar 31, 2026 Commissioned by GenZcash Most crypto privacy models weaken as blockchain data grows. Encryption-based models like Zcash strengthen. CoinDesk Research maps the five privacy approaches and examines the widening gap. Why it matters : As blockchain adoption scales, the metadata available to machine learning models scales with it. Obfuscation-based privacy approaches are structurally degrading as a result. This report provides a comprehensive comparison of all five major crypto privacy architectures and a framework for evaluating which models remain durable as AI capabilities improve. View Full Report More For You SoFi announces 24/7 banking hub that blends traditional cash with crypto By Helene Braun , AI Boost | Edited by Nikhilesh De 2 hours ago The new service lets companies hold dollars, convert to stablecoins and move money instantly within a regulated bank. What to know : SoFi said it is launching SoFi Big Business Banking, a platform that lets companies manage U.S. dollars and crypto, including stablecoins, within its regulated bank. The service aims to replace the current patchwork of banks, stablecoin issuers and custodians by enabling 24/7 deposits, conversions into SoFiUSD and instant movement of... Read full story Latest Crypto News Oil shock, Iran war risk keep crypto investors on sidelines: Grayscale 53 minutes ago The 'time pain' trap: why bitcoin’s bear market might need a few more months of ‘boring’ to hit a true floor 1 hour ago CoinDesk 20 performance update: index falls 4.5% as all constituents trade lower 1 hour ago Coinbase’s AI payments system joins Linux Foundation, gathers support from Google, Stripe, AWS and others 1 hour ago Startup lets researchers mine blockchain tasks on a quantum computer for the first time 2 hours ago SoFi announces 24/7 banking hub that blends traditional cash with crypto 2 hours ago Top Stories Bitcoin, ether, solana slide further as Trump threatens to hit Iran 'extremely hard' 10 hours ago The bitcoin treasury boom is unwinding as some companies and governments sell holdings 5 hours ago Solana DeFi platform Drift confirms 'active attack' as $200M+ leaves platform 20 hours ago Three key signals to watch as bitcoin whipsaws on Trump’s Iran rhetoric 9 hours ago Metaplanet acquires 5,075 BTC, jumps to third largest bitcoin treasury company 5 hours ago Bitcoin’s crashes are shrinking, and Wall Street is starting to notice Apr 1, 2026