Home / Crime and Justice / North Korea Hackers Stole $285M in Crypto Heist
North Korea Hackers Stole $285M in Crypto Heist
7 Apr
Summary
- Drift protocol lost $285 million in a sophisticated crypto hack.
- Attackers used fake tokens and manipulated price tools to drain funds.
- Intelligence operation linked to North Korea is suspected of the theft.
A sophisticated six-month intelligence operation, allegedly orchestrated by a North Korean-linked hacking group, led to the theft of approximately $285 million from the Drift crypto protocol on Solana. The attack, which occurred on April 1, 2026, saw hackers exploit Drift's systems by creating 750 million fake CarbonVote Tokens (CVT). They manipulated the protocol's price-checking tools to treat these worthless tokens as legitimate collateral, enabling them to borrow and withdraw substantial amounts of real assets.
The operation began in mid-March 2026 with attackers using mixing services to obscure their tracks and preparing transactions. A critical vulnerability was exploited after Drift's security team switched to a new approval system on March 27, 2026, which required fewer sign-offs and lacked a waiting period for alerts. Within approximately 12 minutes on April 1, 2026, the hackers drained real assets and quickly converted them to USDC before moving to the Ethereum network.
Forensic analysis by TRM Labs and Elliptic indicated patterns consistent with prior North Korean state-affiliated activities, including staging transactions aligned with Pyongyang local time. Indicators suggest the perpetrators posed as a legitimate quantitative trading firm, engaging with Drift contributors over six months through conferences, in-person meetings, and private messaging groups. This lengthy trust-building phase was designed to mask their true intentions, with the group erasing their digital footprints post-heist.
Security researchers note that this attack vector, relying on private key compromise rather than pure code vulnerability, and the ability to manipulate asset collateralization, mirrors recent exploits on other protocols. The sophistication and patience displayed in this six-month campaign raise concerns about potential ongoing operations targeting other crypto projects. North Korea has a documented history of utilizing cryptocurrency theft for funding, with billions stolen in previous years.
