Drift Protocol DPRK Exploit (April 2026)
Last changed 2026-10-16 · Community evidence — A moderator accepted a piece of community-submitted evidence: AmbCrypto confirms Drift Protocol's recovery plan: $1-per-dollar 'recovery tokens', a pool drawing up to $127.5M from Tether plus up to $20M in partner capital targeting the ~$295M loss, and a Q2 2026 relaunch with redesigned, security-focused architecture — matching the exonerating claim in full. Trust score now 0. Version history →
Incidents are rated for severity, not trust. The trust score is on Drift Protocol.
Summary
On April 1, 2026, Drift Protocol — the largest decentralized perpetual futures exchange on Solana — suffered a loss of approximately $295 million in user assets after a six-month social engineering campaign attributed with medium-high confidence to UNC4736, a North Korean state-affiliated threat actor also tracked as AppleJeus or Citrine Sleet. Attackers posed as a quantitative trading firm, compromised Security Council members' devices, and exploited Solana's durable nonce mechanism to gain unauthorized administrative control before draining multiple vaults within roughly twelve minutes. Drift Protocol acknowledged the breach and published a token-based recovery framework backed by Tether ($127.5 million) and other partners, with a Q2 2026 protocol relaunch planned.
Connected Entities
11 entities · 60 linked investigations- ZachXBT→mentioned with→Ethereum(70%)
- Drift Protocol DPRK Exploit (April 2026)→mentioned with→Ethereum(70%)
- Drift Protocol DPRK Exploit (April 2026)→mentioned with→Drift(85%)
- Drift Protocol DPRK Exploit (April 2026)→mentioned with→Wormhole(70%)
- Drift Protocol DPRK Exploit (April 2026)→mentioned with→Tether(70%)
- Drift Protocol DPRK Exploit (April 2026)→mentioned with→Solana(80%)
- Drift Protocol DPRK Exploit (April 2026)→mentioned with→ZachXBT(60%)
- Citrine Sleet / AppleJeus→mentioned with→Drift Protocol(80%)
- CarbonVote Token→mentioned with→Drift Protocol(80%)
- CarbonVote Token→mentioned with→Citrine Sleet / AppleJeus(80%)
- + 28 more
Connected Through
10 shared actors · 631 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Ethereumorganization
- □ZachXBTorganization
- □Solanaorganization
- □Tetherorganization
Community submissions
- Drift Protocol DPRK Exploit — Recovery Plan and Relaunch(ambcrypto.com)
“[Scout] AmbCrypto reports that Drift Protocol outlined a recovery plan for users affected by its $295 million exploit, under which Drift will issue 'recovery tokens' representing $1 of verified loss; the recovery pool draws on up to $127.5 million from Tether and additional partner capital of up to $20 million, and will grow until it matches total losses of approximately $295 million. Drift is targeting a Q2 2026 relaunch with a redesigned, security-focused architecture.”
— avoid-scout(unverified)
- https://www.cryptotimes.io/2026/07/24/44-4m-eth-moved-drift-protocol-exploiter-breaks-3-month-silence/(www.cryptotimes.io)
“[Scout] The Drift Protocol exploiter moved 23,095 ETH (roughly $44.4 million) into Tornado Cash on July 23, 2026, breaking a dormancy that had stretched since late April.”
— avoid-scout(unverified)
5 submissions awaiting moderator review.
Timeline(14 events)
2025
Attackers posing as a quantitative trading firm make initial contact with Drift contributors at a major cryptocurrency conference (approximate date; reported as 'fall 2025')
CoinDesk / Drift post-mortemDecember 2025
Fake trading firm onboards an Ecosystem Vault, begins technical sessions with Drift contributors, and deposits over $1 million in capital to establish credibility
CoinDesk / Drift post-mortemFebruary 2026
In-person meetings between attacker intermediaries and Drift contributors occur at multiple industry conferences across several countries
The Hacker News11 March 2026
Attacker withdraws initial 10 ETH from Tornado Cash to fund subsequent attack preparation
TRM Labs12 March 2026
CarbonVote Token (CVT) deployed on Solana with a total supply of 750 million tokens; attack preparatory activity timestamps around 09:00 Pyongyang time noted by TRM Labs
TRM Labs23 March 2026
Four durable nonce accounts created on Solana: two associated with legitimate Drift Security Council members (indicating device compromise), two controlled by the attacker
CoinDesk Tech27 March 2026
Drift Protocol executes a planned Security Council migration to replace a member; attacker subsequently re-obtains required pre-signatures
CoinDesk Tech30 March 2026
New durable nonce account appears tied to updated multisig member, confirming attacker has re-secured the 2-of-5 approval threshold
CoinDesk TechApril 2026
Attack executed: two transactions four slots apart on Solana grant attacker full administrative control; CVT whitelisted as collateral; approximately $285-295 million drained from three vaults in roughly twelve minutes via thirty-one withdrawal transactions
Elliptic / TRM Labs / BloombergApril 2026
Stolen assets rapidly swapped to USDC via Solana DEX aggregators and bridged to Ethereum, converted to ETH; Drift Protocol suspends operations
Elliptic2 April 2026
Elliptic flags the exploit as likely North Korea-linked; CoinDesk publishes technical analysis of durable nonce attack vector
CoinDesk5 April 2026
Drift Protocol publishes post-mortem attributing the six-month operation to UNC4736 (AppleJeus / Citrine Sleet) at medium-high confidence, citing Mandiant forensic investigation and on-chain fund flow overlaps with the October 2024 Radiant Capital hack
CoinDesk16 April 2026
Drift Protocol publishes incident recovery update confirming $295,706,374.93 in losses; approximately $3.36 million USDC frozen; ~130,259 ETH (~$31 million) in monitored attacker wallets; public bounty offering 10% of recovered assets announced
Drift Protocol (official)5 May 2026
Drift Protocol publishes full recovery plan: SPL recovery tokens issued to affected wallets at $1 per token, recovery pool targeting $295.4 million backed by Tether ($127.5 million), partners ($20 million), and exchange revenue; USDC-to-USDT settlement migration announced; Q2 2026 relaunch planned
CoinDeskDecision Log
- slot 457804035 · hash ESXiBdoUG5Nhm3VMHYdh1S1MdCQLiEHNFPryHSzRxbRX
- slot 457736947 · hash HuAqxCoCExXjaNknznBB7MzLHim3NwsTiWvdPAXiQaLE
- slot 445507740 · hash jk66U2TJxrKK6tY58HDmkXaoZCiSnMAnPrcdig4d1wA
- slot 443511816 · hash 7YSaWYu8nYU2y5NtejfovW1cyJzKeQZQh42M8QUMzuqW
- slot 443511803 · hash 7djkE2nz9bE6t9iP82r2yVYsLNWfGTh9YqMcur2E37Sd
- slot 426948488 · hash 79wiSaU44YdKAT5RtugE15rVFEtkTSoSHW2JvWo28ukd
This investigation is cryptographically anchored to the Solana blockchain (6 decisions). 20 of 21 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 6/16/2026, 11:04:48 PM
last updated: 10/16/2026, 10:28:24 PM
4 viewsavoid.net — verified advice for a post-truth world