Drift Protocol suffered a $280 million hack linked to a North Korean group, revealing extensive infiltration planning over six months.
Drift Protocol has revealed that a significant hack on April 1 resulted in losses of approximately $280 million, attributed to a North Korean hacking group known as UNC4736.
The attack was characterized as a "structured infiltration operation" that required extensive planning and resources, taking six months to execute. The hackers managed to build trust with Drift's team by posing as legitimate partners.
Infiltration Strategy
In the fall of 2025, representatives from a trading company approached Drift at a conference, expressing interest in collaborating. This front company spent months cultivating a relationship, even investing over $1 million into the project. They created a Telegram group for discussions about trading strategies, which eventually facilitated their infiltration.
Drift noted that the attackers were not strangers but individuals whom project members had worked with closely, sharing various project tools and applications.
Attack Mechanisms
The hackers utilized sophisticated methods to compromise Drift's storage repositories, including the use of fake delayed signatures. Initial investigations have identified three potential attack vectors:
- A staff member may have inadvertently cloned a code repository under false pretenses.
- Another team member was tricked into downloading a malicious application masquerading as an electronic wallet.
- A vulnerability in the repositories might have allowed unauthorized code execution through simple file interactions.
Drift is currently conducting a forensic analysis of the affected systems with the help of SEALS 911 and law enforcement, while the protocol's operations remain halted.
Perpetrators Identified
Investigative findings have linked the attack to UNC4736, also referred to as AppleJeus or Citrine Sleet, a group previously involved in the hack of Radiant Capital, which caused over $50 million in losses in October 2024. The hackers employed fabricated identities to gain access to the Drift team.
Drift emphasized that the individuals who engaged with them were not North Korean citizens, highlighting that operatives often use intermediaries for such infiltrations.
In addition, this North Korean group has been implicated in various cyberattacks, including a recent assault on the cryptocurrency online store Bitrefill.
