The recent $285 million hack on the Solana-based DeFi platform Drift Protocol wasn’t any run-of-the-mill exploit.
Drift Protocol says in a new incident update that the April 1st attack was the result of six months of careful manipulation from North Korean-backed impostors.
“In or about Fall 2025, Drift contributors were approached by a group of individuals at a major crypto conference who presented as a quantitative trading firm looking to integrate on the protocol. It is now understood that this appears to be a targeted approach, where individuals from this group continued to deliberately seek out and engage specific Drift contributors, in person, at multiple major industry conferences in multiple countries over the following six months.
They were technically fluent, had verifiable professional backgrounds, and were familiar with how Drift operated. A Telegram group was established upon the first meeting, and what followed were months of substantive conversations around trading strategies and potential vault integrations. These interactions are typical of how trading firms interact and onboard with Drift.”
The impostors onboarded an Ecosystem Vault on Drift in December and January, engaging with multiple contributors in a number of different working sessions and depositing more than $1 milllion worth of their own capital.
“Integration conversations continued through February and March 2026. Various Drift contributors met individuals from this group again, face-to-face, at multiple major industry conferences. By this point, the relationship was nearly half a year old. These were not strangers; they were people Drift contributors had worked with and met in person.
Throughout all of this, links were shared for projects, tools, and apps they claimed to be building, which was standard practice for trading firms.”
Drift Protocol says investigations have concluded with “medium-high confidence” that the attack was orchestrated by the same North Korean-linked criminal group that hacked the DeFi platform Radiant Capital in 2024.
The project notes, however, that none of the individuals they met with in person in the lead-up to the attack were North Korean nationals.
“DPRK threat actors operating at this level are known to deploy third-party intermediaries to conduct face-to-face relationship-building…
The investigation has shown so far that the profiles used in this third party targeted operation had fully constructed identities including employment histories, public-facing credentials and professional networks. The people Drift contributors met in person appeared to have spent months building profiles, both personal and professional, that could withstand scrutiny during a business or counterparty relationship.”
Follow us on X, Facebook and Telegram
Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox
Surf The Daily Hodl Mix
 
Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any assets including cryptocurrencies, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.
Generated Image: Midjourney
The post ‘Six Months in the Making’: Drift Protocol Says $285,000,000+ Hack Involved North Korean-Backed Impostors at Multiple Crypto Conferences appeared first on The Daily Hodl.
The recent $285 million hack on the Solana-based DeFi platform Drift Protocol wasn’t any run-of-the-mill exploit. Drift Protocol says in a new incident update that the April 1st attack was the result of six months of careful manipulation from North Korean-backed impostors. “In or about Fall 2025, Drift contributors were approached by a group of
The post ‘Six Months in the Making’: Drift Protocol Says $285,000,000+ Hack Involved North Korean-Backed Impostors at Multiple Crypto Conferences appeared first on The Daily Hodl. Scams, Hacks & Breaches, Crypto, drift, Drift protocol, Hack, News
This articles is written by : Nermeen Nabil Khear Abdelmalak
All rights reserved to : USAGOLDMIES . www.usagoldmines.com
You can Enjoy surfing our website categories and read more content in many fields you may like .
Why USAGoldMines ?
USAGoldMines is a comprehensive website offering the latest in financial, crypto, and technical news. With specialized sections for each category, it provides readers with up-to-date market insights, investment trends, and technological advancements, making it a valuable resource for investors and enthusiasts in the fast-paced financial world.