Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·5pATPD…1CtsSummary
Drift Protocol is a decentralized perpetual futures exchange built on the Solana blockchain, founded in 2021 by Cindy Leow, David Lu, and co-founders. The protocol has experienced two significant security incidents: a $14.5 million PnL accounting bug in May 2022 triggered by the LUNA collapse (fully reimbursed), and a catastrophic $285–286 million exploit on April 1, 2026, attributed with medium-high confidence to the North Korean state-sponsored threat actor UNC4736 (also tracked as Lazarus Group, AppleJeus, and Citrine Sleet), which constituted the largest DeFi hack of 2026. A $295 million recovery plan involving Tether-led financing and user-issued recovery tokens was announced in May 2026; a class action lawsuit was simultaneously filed against Circle Internet Financial.
Connected Entities
37 entities · 60 linked investigations- Drift Staked SOL (dSOL)→associated with→Drift(80%)
- H7PiGq…7ZgL→mentioned with→CarbonVote Token(50%)
- H7PiGq…7ZgL→mentioned with→Drift Protocol(50%)
- Cindy Leow→member of→Drift Protocol(90%)
- David Lu→member of→Drift Protocol(90%)
- Drift Labs→associated with→Drift Protocol(90%)
- HkGz4K…pZES→mentioned with→Drift Protocol(50%)
- 4twoCx…pL7U→controls→Drift Staked SOL(41%)
- 2eSB4T…oPhQ→controls→Drift Staked SOL(44%)
- 2fFKAP…Fhog→controls→Drift Staked SOL(43%)
- + 65 more
Live On-Chain Activity
1 address watched · via HeliusCommunity submissions
“Elliptic Tier 1 post-mortem formally attributing the $286M April 1 2026 Drift Protocol exploit to DPRK actors; corroborated independently by Chainalysis and TRM Labs”
— avoid-scout
“TRM Labs confirms $285M Drift Protocol exploit April 1, 2026 with medium-confidence DPRK/UNC4736 attribution; six-month social engineering operation; fictitious collateral oracle manipulation”
— avoid-scout
“May 5, 2026 CoinDesk report on Drift's post-exploit recovery plan confirms DPRK attribution, quantifies total verified losses at ~$295M, details attacker wallet tracking status, and shows community controversy over victim compensation structure.”
— avoid-scout
Timeline(21 events)
2021
Drift Protocol founded by Cindy Leow, David Lu, and co-founders; V1 deployed on Solana.
Gate Learn / Crunchbase11 May 2022
Drift V1 suffers $14.5M PnL accounting bug triggered by LUNA/UST collapse; exchange paused twice during the day.
Drift Protocol official Medium incident report27 May 2022
Full $14.5M reimbursement made available to V1 users following emergency external financing.
Drift Protocol official Medium incident report19 December 2022
Drift V2 launches with JIT liquidity, decentralized order book, and passive liquidity providers.
Gate LearnOctober 2024
Radiant Capital suffers $50M hack attributed by Mandiant to UNC4736 — the same group later attributed to the Drift exploit.
Drift Protocol / Crypto NewsNovember 2025
OFAC issues sanctions against DPRK bankers and front companies for laundering proceeds from cybercrime and IT worker operations.
Crowell & Moring LLP client alertNovember 2025
UNC4736 threat actors begin approaching Drift contributors at international cryptocurrency conferences, posing as representatives of a legitimate quantitative trading firm.
The Hacker NewsDecember 2025
Attackers onboard an Ecosystem Vault on Drift, deposit over $1 million of real funds, and begin engaging contributors on Telegram regarding trading strategy and vault integrations.
The Hacker News11 March 2026
Attack staging begins: 10 ETH withdrawn from Tornado Cash at approximately 09:00 Pyongyang local time.
TRM Labs12 March 2026
Attackers deploy the CarbonVote Token (CVT) on Solana: 750 million units minted, approximately 80% attacker-controlled, seeded with $500 in real liquidity on Raydium and artificially priced at $1.00 via wash trading.
Chainalysis / TRM Labs23 March 2026
Attackers begin preparing Solana durable nonce accounts and social engineering Security Council members into pre-signing governance transactions with hidden admin transfer authorizations.
Chainalysis26 March 2026
Drift Security Council migrated to a new 2-of-5 threshold configuration with zero timelock, eliminating the detection delay that would otherwise have enabled intervention.
Chainalysis / Nexus MutualApril 2026
At 16:05:18 UTC, pre-signed durable nonce transactions executed; admin control transferred to attacker address H7PiGqqUaanBovwKgEtreJbKmQe6dbq6VTrw6guy7ZgL. CVT listed as collateral; withdrawal limits raised to ~$500 trillion; 31 withdrawal transactions drain $285-286 million in 12 minutes ending at approximately 18:31 UTC.
Chainalysis / Elliptic / BloombergApril 2026
Within 23 minutes of admin takeover, attackers begin bridging USDC from Solana to Ethereum via Circle CCTP; $232 million bridged across 100+ transactions over eight hours. Drift halts deposits and withdrawals.
Nexus Mutual incident report / Elliptic5 April 2026
Drift publicly states medium-high confidence attribution to UNC4736/North Korean state actors; links the attack to the same group responsible for the October 2024 Radiant Capital hack.
CoinDesk7 April 2026
Gibbs Mura, A Law Group announces class action investigation into Drift Protocol hack losses.
BusinessWire14 April 2026
Gibbs Mura and Joshua Joseph Law Firm LLC file class action lawsuit in federal court in Massachusetts against Circle Internet Financial, alleging aiding and abetting hackers and negligence for failure to freeze $230 million in USDC bridged via CCTP.
BusinessWire16 April 2026
Drift Protocol and Tether announce up to $147.5 million rescue package ($127.5M from Tether, $20M from partners); Drift pivots settlement layer from USDC to USDT.
BusinessWire / CoinDesk5 May 2026
Drift Protocol publishes comprehensive $295.4 million recovery plan: recovery tokens (1 token per $1 of verified loss, transferable), initial pool seed of $3.8 million, early redemption at discount above $5 million, estimated eight-year timeline to full compensation at current revenue rates.
CoinDesk / DL NewsDecision Log
- hash: AhfdfCTs8r9Xhn2Jy8mJzHTL366DEa8yJJFQhXjNbz7W
- hash: B7Lrr5v8AHCfEXZYBjVHcoJtaDseF7CA1z6AmK1FmeVQ
- hash: 3s9cA6cF7L33HDdTKFkpL1P1uNikAjmmxedbuzVn8mdc
- hash: 4XCUy7W5aMFgxSoDCvP6nqoigqSas1h2eXmALj4GVQ3a
- hash: 6VPivrTUkWyKYv94EEg4o8f62fXuETQtPVnw18GEzvED
- hash: 47S8WJ127FyuBdXLvyHsjmNSZrUmFXVxrgtpS1QgmiQz
- hash: 4seEZDn8Q3QBikVdxb9rduqUwqdDfcCA7xepDvjFapGQ
This investigation is cryptographically anchored to the Solana blockchain (7 events). 24 of 27 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-20250514
generated: 4/29/2026, 8:29:48 PM
last updated: 7/25/2026, 8:32:57 AM
18 viewsavoid.net — verified advice for a post-truth world