Experts have linked the $280 million Drift hack to North Korea's Lazarus Group, known for major cryptocurrency thefts.
Security researchers from Diverg, TRM Labs, and Elliptic have attributed a significant $280 million hack of the decentralized finance (DeFi) platform Drift to North Korea's Lazarus Group, also known as TraderTraitor. This hacking group has previously been implicated in major thefts, including the $1.5 billion attack on Bybit and the $625 million breach of the Ronin network.
Initial assumptions about the breach indicated a single compromise of Drift's multi-signature wallet; however, further investigation revealed a more complex approach. The hacker exploited weaknesses in the updated security measures implemented on March 27, which required multiple signatures for transaction approvals. Just days after these changes, the hacker bypassed the new security to execute a delayed signature mechanism.
Attack Strategy
The attack preparations began on March 11, when the hacker withdrew 10 ETH through Tornado Cash, a service known for anonymizing transactions. They utilized a series of temporary wallets and cross-chain bridges to obscure the origin of the funds. On March 12, the hacker created 750 million fraudulent CVT tokens, further complicating the detection process.
Contrary to initial reports claiming multiple ETH withdrawals funded the hack, experts clarified that only one transaction of 10 ETH was involved, with the remainder being allocated to address masking services.
Funds Withdrawal and Behavior
Following the exploit, Diverg's analysis revealed that the hacker executed a rapid withdrawal of funds, converting $14.6 million in USDC and a substantial amount of WBTC into nearly 13,150 ETH using the CoW Protocol. They systematically withdrew funds from various wallets, indicating a well-planned strategy.
The hacker's actions were synchronized with business hours in Pyongyang, aligning with known operational patterns of the Lazarus Group. Their tactics have evolved, now involving the issuance of fake tokens and manipulation of price data to enhance collateral values, marking a notable shift in their methodology.
According to Elliptic, the Drift incident represents the 18th known attack attributed to Lazarus in 2026, highlighting the persistent threat posed by this group. Recent suspicions also connect them to the earlier attack on the cryptocurrency retailer Bitrefill in March.
