Drift Protocol exploited for $286 million in suspected DPRK-linked attack
Contents
Elliptic has identified multiple indicators suggesting that the exploit of Drift Protocol is linked to the Democratic People's Republic of Korea (DPRK).
Drift Protocol, the largest decentralized perpetual futures exchange on the Solana blockchain, experienced a major security incident on April 1, 2026. Elliptic calculated that the combined value of assets stolen in this exploit was $286 million. The on-chain behavior, laundering methodologies and network-level indicators associated with the attack are consistent with techniques observed in previous DPRK-attributed operations.
If confirmed, this incident would represent the eighteenth DPRK act Elliptic has tracked this year, with over $300 million stolen so far. It is a continuation of the DPRK’s sustained campaign of large-scale cryptoasset theft, which the US government has linked to the funding of its weapons programs. DPRK-linked actors are believed to have stolen over $6.5 billion dollars in cryptoassets in recent years.
This latest incident also takes place amid a broader escalation …
Drift Protocol, the largest decentralized perpetual futures exchange on the Solana blockchain, experienced a major security incident on April 1, 2026. Elliptic calculated that the combined value of assets stolen in this exploit was $286 million. The on-chain behavior, laundering methodologies and network-level indicators associated with the attack are consistent with techniques observed in previous DPRK-attributed operations.
If confirmed, this incident would represent the eighteenth DPRK act Elliptic has tracked this year, with over $300 million stolen so far. It is a continuation of the DPRK’s sustained campaign of large-scale cryptoasset theft, which the US government has linked to the funding of its weapons programs. DPRK-linked actors are believed to have stolen over $6.5 billion dollars in cryptoassets in recent years.
This latest incident also takes place amid a broader escalation …