Drift protocol (DRIFT)

How Project Founders Can Identify the North Korean Lazarus Hacker Group The Lazarus Group is currently being pointed to as the culprit behind the recent @DriftProtocol hack. What makes this incident so terrifying is that it wasn't a technical exploit of system vulnerabilities—it was a thoroughly designed and meticulously planned social engineering attack. However, there is one fascinating fact: South Korean projects have almost never fallen victim to social engineering attacks by Lazarus. While a small sample size might be part of it, I believe the real reason is simple: South Koreans can spot North Koreans. For foreigners, distinguishing between a South Korean and a North Korean can be nearly impossible. But for us? We can instantly catch the subtle differences in their tone, appearance, behavior, and how they respond to questions. This is not something AI can detect. "What if they completely fake it, pretending to be foreigners who don't speak a word of Korean?" Even then, we can filter them out with one simple request. Just ask them to say: "Kim Jung-un is a son of a xxxxx" (김정은 개새끼). Since I am not a North Korean Lazarus hacker, I can say it loud and clear: Kim Jung-un is a son of a xxxxx. To all global blockchain projects out there: Hire a South Korean security officer immediately. *Note: Only native South Koreans who actually grew up in South Korea can catch these subtle nuances. This is not a joke. I am attaching an actual documentary broadcasted by South Korean TV network Channel A, demonstrating exactly how to identify a North Korean hacker. https://t.co/Yz762Gbfou

Drift Protocol Hack: What Really Happened On April 1, 2026, Solana's Largest Perps DEX @DriftProtocol was exploited for $285M, the biggest DeFi hack of 2026. This wasn't a smart contract bug. It was a 6-month social engineering operation linked to North Korean state hackers. How It Happened: → Attackers posed as a quant trading firm since Fall 2025 → Met Drift team face-to-face at multiple conferences → Deposited $1M+ of their own capital to build trust → Compromised contributor devices through malicious code repos and a fake wallet app → Used Solana's "durable nonces" to pre-sign admin transfers weeks in advance → Drained $285M in just 12 minutes → Scrubed all evidence instantly after the attack Key Impact: → $DRIFT token dropped 47%+ → TVL collapsed from $550M to under $250M → 12+ Solana protocols affected → Circle facing backlash for not freezing $232M $USDC fast enough → Mandiant engaged for investigation Biggest Lesson: Audits alone are NOT enough. DeFi's weakest link is now the human layer. Every team must enforce timelocks, audit access controls and treat every multisig device as a potential target. Stay cautious. Stay informed.

Drift hack explained in full. https://t.co/SbzH2sk8xk

This is absolutely wild. $270m hack came down to fake app developers playing the long game and phishing multi-sig holders with a TestFlight app. Almost a decade ago, I watched my team at Tokensoft setup clients with air gapped machines and multi-sigs while preaching security to a growing class of finance clients developing protocols about what attack vectors could be thrown at them. Hearing the levels the Drift hackers went to social engineer the multi-sig holders into installing their fake TestFlight apps is next level. But, it is clear the Drift team and multi-sig holders never battle tested their security setup or used known security protocols now over a decade old.

$287,000,000 Drift protocol hack didn’t happen overnight; it was planned for 6 months. It started in late 2025. A group approached Drift at conferences, posing as a legit trading firm. They knew the product, asked the right questions, and slowly built trust. They didn’t rush anything. They joined calls, asked smart questions, and even deposited $1M+ into Drift. Everything looked normal. Then they went deeper. More meetings. More conversations. By early 2026, they were no longer outsiders; they were trusted. Then came the setup. They shared links, code repositories, and even a TestFlight app. All of it looked standard for crypto collaboration. But this is where things changed. One wrong click. One cloned repo. One installed app. That’s all it took. On April 1st, the attack was executed. $287M drained. And right after it happened… they disappeared. Chats wiped. Tools deleted. No trace left behind. Now investigators believe this wasn’t random. This was a coordinated operation, planned for months, possibly linked to state‑backed actors.

🚨 EXPLOIT: Drift Protocol hit with ~$280M hack after months-long infiltration. https://t.co/Jj0NZ97yYh