{"id":95923,"date":"2026-04-05T15:00:54","date_gmt":"2026-04-05T12:00:54","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=95923"},"modified":"2026-04-05T15:05:13","modified_gmt":"2026-04-05T12:05:13","slug":"drift-protocol-reveals-details-of-280-million-hack","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/drift-protocol-reveals-details-of-280-million-hack\/","title":{"rendered":"Drift Protocol Reveals Details of $280 Million Hack"},"content":{"rendered":"<p>The cyberattack on Drift Protocol was described as a &#8220;structured infiltration operation requiring organizational support, significant resources, and several months of meticulous preparation.&#8221;<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"zxx\" dir=\"ltr\"><a href=\"https:\/\/t.co\/qYBMCup9i6\">https:\/\/t.co\/qYBMCup9i6<\/a><\/p>\n<p>\u2014 Drift (@DriftProtocol) <a href=\"https:\/\/twitter.com\/DriftProtocol\/status\/2040611161121370409?ref_src=twsrc%5Etfw\">April 5, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>According to the project&#8217;s team, the incident on April 1, which resulted in damages of approximately $280 million, was orchestrated by a group from North Korea. They spent six months planning and executing the attack.\u00a0<\/p>\n<h2 class=\"wp-block-heading\">Infiltration<\/h2>\n<p>Representatives of Drift stated that in the autumn of 2025, individuals claiming to represent an unnamed trading company approached them at a thematic conference, expressing a desire to integrate into the protocol.<\/p>\n<p>It was later discovered that the criminals deliberately monitored project participants and gained their trust.<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>&#8220;They possessed technical skills, had verified professional experience, and were familiar with Drift&#8217;s operations. After the first meeting, we created a group in Telegram, which was followed by months of substantive discussions on trading strategies and potential storage integration,&#8221; the team noted.\u00a0<\/p>\n<\/blockquote>\n<p>The fake company then began connecting its own storage solutions to Drift, which required filling out a form with a detailed strategy description. Additionally, they invested over $1 million of their own funds into the ecosystem.<\/p>\n<p>Close communication between developers and the perpetrators continued until the end of March. After the attack, all shared chats and contacts were deleted.<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>&#8220;These were not strangers, but people with whom project participants worked and met personally. Throughout this process, links to projects, tools, and applications were shared,&#8221; Drift emphasized.\u00a0<\/p>\n<\/blockquote>\n<h2 class=\"wp-block-heading\">Mechanisms of the Hack<\/h2>\n<p>As previously reported, the hackers gained access to depository storage through the creation of fake deferred signatures. The team has now identified three likely attack vectors:<\/p>\n<ol class=\"wp-block-list\">\n<li>One employee may have been compromised after cloning a code repository under the guise of deploying an interface for storage.<\/li>\n<li>Another team member was persuaded to download a malicious TestFlight application, presented as a digital wallet.<\/li>\n<li>A vulnerability was allegedly present in the repositories, allowing any code to be executed unnoticed by simply opening a file, folder, or other documents in the editor.<\/li>\n<\/ol>\n<p>Drift continues forensic analysis of the affected equipment. Specialists from SEALS 911 and law enforcement agencies are assisting in the investigation.\u00a0<\/p>\n<p>The official source of the vulnerability has not yet been identified. The protocol&#8217;s operation remains suspended.<\/p>\n<h2 class=\"wp-block-heading\">Specific Culprit<\/h2>\n<p>Data obtained during the investigation linked the attack to the group UNC4736, a North Korean state entity also known as AppleJeus or Citrine Sleet.\u00a0<\/p>\n<p>The same criminals were allegedly behind the <a href=\"https:\/\/forklog.com\/en\/news\/radiant-capital-hacked-for-over-50-million\">hack of Radiant Capital<\/a> for over $50 million in October 2024. They were traced through on-chain data indicating common financial flows, as well as related real-world identities.\u00a0<\/p>\n<p>To infiltrate Drift, the criminals provided completely fabricated data, including employment history, personal information, and professional contacts.\u00a0<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>&#8220;It is important to note: the individuals who met [with Drift representatives] were not North Korean citizens. It is known that North Korean terrorists operating at this level use intermediaries to establish personal contacts,&#8221; the company noted.\u00a0<\/p>\n<\/blockquote>\n<p>Earlier in March, the North Korean group was <a href=\"https:\/\/forklog.com\/en\/news\/lazarus-group-suspected-in-bitrefill-cyberattack\">suspected<\/a> of attacking the cryptocurrency online store Bitrefill.\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The cyberattack on Drift Protocol was described as a &#8220;structured infiltration operation requiring organizational support, significant resources, and several months of meticulous preparation.&#8221;<\/p>\n","protected":false},"author":1,"featured_media":95924,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"Hackers spent six months personally communicating with the project team","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[44,1202],"class_list":["post-95923","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-cybercrime","tag-north-korea-dprk"],"aioseo_notices":[],"amp_enabled":true,"views":"13","promo_type":"1","layout_type":"1","short_excerpt":"Hackers spent six months personally communicating with the project team","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/95923","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=95923"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/95923\/revisions"}],"predecessor-version":[{"id":95925,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/95923\/revisions\/95925"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/95924"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=95923"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=95923"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=95923"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}