v2 → v3
Scores
trust_score0 → 0
severity_base— → —
score_modifier-1.4 → 0
Sections
Incident Overview
unchanged
DPRK Attribution
unchanged
Social Engineering Operation (Fall 2025 – March 2026)
unchanged
Technical Attack Mechanism: Durable Nonces and Fake Collateral
unchanged
Fund Movement and Laundering
unchanged
Recovery Plan and User Compensation
unchanged
Regulatory and Legal Context
unchanged
Broader DPRK Crypto Threat Context
unchanged
Security Failures and Post-Incident Recommendations
unchanged
Timeline events
No timeline changes.
Accepted submissions
+ addedurlexonerating
{"url":"https://ambcrypto.com/drift-unveils-recovery-plan-after-295m-dprk-linked-exploit-introduces-user-claim-tokens/","note":"Drift Protocol published a formal recovery plan in May 2026 following its $285-295M DPRK-attributed exploit on April 1. The plan introduces recovery tokens pegged to $1 of verified user loss, backed by a pool seeded at $3.8M targeting $151M via revenue and partners — far short of total losses, causing community backlash. The protocol relaunched in Q2 2026 with new multisig controls and timelocks. As of late July 2026, a wallet linked to the attacker moved 23,095 ETH (~$44M) through Tornado Cash, indicating active laundering is ongoing.","title":"Drift Protocol DPRK Exploit — Recovery Plan and Relaunch"}Each version is bound to the decision event that created it. Verify the chain anchor for either via the audit log.
v2 hash: HuAqxCoCExXjaNknznBB7MzLHim3NwsTiWvdPAXiQaLE
v3 hash: ESXiBdoUG5Nhm3VMHYdh1S1MdCQLiEHNFPryHSzRxbRX