On April 1, 2026, Drift Protocol lost about $285 million in a coordinated Solana DeFi attack with preliminary indicators consistent with DPRK-linked operations. Attackers used durable nonce transactions and social engineering around multisig signing to gain administrative control, whitelist a fake collateral token with manipulated pricing, remove withdrawal limits, and drain assets including USDC, JLP, cbBTC, USDT, WETH, and other tokens.