{"id":40182,"date":"2026-04-06T18:41:27","date_gmt":"2026-04-06T18:41:27","guid":{"rendered":"https:\/\/cryptomag.finance\/?p=40182"},"modified":"2026-04-06T18:41:27","modified_gmt":"2026-04-06T18:41:27","slug":"six-months-in-the-making-drift-protocol-says-285000000-hack-involved-north-korean-backed-impostors-at-multiple-crypto-conferences","status":"publish","type":"post","link":"https:\/\/cryptomag.finance\/?p=40182","title":{"rendered":"\u2018Six Months in the Making\u2019: Drift Protocol Says $285,000,000+ Hack Involved North Korean-Backed Impostors at Multiple Crypto Conferences"},"content":{"rendered":"

\"\"<\/p>\n

The recent $285 million hack on the Solana-based DeFi platform Drift Protocol wasn\u2019t any run-of-the-mill exploit.<\/p>\n

Drift Protocol says<\/a> in a new incident update that the April 1st attack<\/a> was the result of six months of careful manipulation from North Korean-backed impostors.<\/p>\n

\u201cIn or about Fall 2025, Drift contributors were approached by a group of individuals at a major crypto conference who presented as a quantitative trading firm looking to integrate on the protocol. It is now understood that this appears to be a targeted approach, where individuals from this group continued to deliberately seek out and engage specific Drift contributors, in person, at multiple major industry conferences in multiple countries over the following six months.<\/em><\/p>\n

They were technically fluent, had verifiable professional backgrounds, and were familiar with how Drift operated. A Telegram group was established upon the first meeting, and what followed were months of substantive conversations around trading strategies and potential vault integrations. These interactions are typical of how trading firms interact and onboard with Drift.\u201d<\/em><\/p>\n

The impostors onboarded an Ecosystem Vault on Drift in December and January, engaging with multiple contributors in a number of different working sessions and depositing more than $1 milllion worth of their own capital.<\/p>\n

\u201cIntegration conversations continued through February and March 2026. Various Drift contributors met individuals from this group again, face-to-face, at multiple major industry conferences. By this point, the relationship was nearly half a year old. These were not strangers; they were people Drift contributors had worked with and met in person.<\/em><\/p>\n

Throughout all of this, links were shared for projects, tools, and apps they claimed to be building, which was standard practice for trading firms.\u201d<\/em><\/p>\n

Drift Protocol says investigations have concluded with \u201cmedium-high confidence\u201d that the attack was orchestrated by the same North Korean-linked criminal group that hacked<\/a> the DeFi platform Radiant Capital in 2024.<\/p>\n

The project notes, however, that none of the individuals they met with in person in the lead-up to the attack were North Korean nationals.<\/p>\n

\u201cDPRK threat actors operating at this level are known to deploy third-party intermediaries to conduct face-to-face relationship-building\u2026<\/em><\/p>\n

The investigation has shown so far that the profiles used in this third party targeted operation had fully constructed identities including employment histories, public-facing credentials and professional networks. The people Drift contributors met in person appeared to have spent months building profiles, both personal and professional, that could withstand scrutiny during a business or counterparty relationship.\u201d<\/em><\/p>\n

Follow us on X<\/a>, Facebook<\/a> and Telegram<\/a><\/span><\/em>
\n
\nDon’t Miss a Beat \u2013 Subscribe<\/a> to get email alerts delivered directly to your inbox <\/span><\/em>
\n
\nSurf The Daily Hodl Mix<\/a><\/span><\/em>
\n<\/p>\n

\n
<\/div>\n

&nbsp<\/p>\n

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any assets including cryptocurrencies, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.<\/h6>\n<\/div>\n

Generated Image: Midjourney<\/em><\/span><\/p>\n

The post \u2018Six Months in the Making\u2019: Drift Protocol Says $285,000,000+ Hack Involved North Korean-Backed Impostors at Multiple Crypto Conferences<\/a> appeared first on The Daily Hodl<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"

The recent $285 million hack on the Solana-based DeFi platform Drift Protocol wasn\u2019t any run-of-the-mill exploit. Drift Protocol says in a new incident update that the April 1st attack was the result of six months of careful manipulation from North Korean-backed impostors. \u201cIn or about Fall 2025, Drift contributors were approached by a group of […]<\/p>\n","protected":false},"author":1,"featured_media":40183,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"footnotes":""},"categories":[],"tags":[],"class_list":["post-40182","post","type-post","status-publish","format-standard","has-post-thumbnail"],"yoast_head":"\n\u2018Six Months in the Making\u2019: Drift Protocol Says $285,000,000+ Hack Involved North Korean-Backed Impostors at Multiple Crypto Conferences - Cryptomag<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptomag.finance\/?p=40182\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u2018Six Months in the Making\u2019: Drift Protocol Says $285,000,000+ Hack Involved North Korean-Backed Impostors at Multiple Crypto Conferences - Cryptomag\" \/>\n<meta property=\"og:description\" content=\"The recent $285 million hack on the Solana-based DeFi platform Drift Protocol wasn\u2019t any run-of-the-mill exploit. Drift Protocol says in a new incident update that the April 1st attack was the result of six months of careful manipulation from North Korean-backed impostors. \u201cIn or about Fall 2025, Drift contributors were approached by a group of […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptomag.finance\/?p=40182\" \/>\n<meta property=\"og:site_name\" content=\"Cryptomag\" \/>\n<meta property=\"article:published_time\" content=\"2026-04-06T18:41:27+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/dailyhodl.com\/wp-content\/uploads\/2023\/05\/Altcoins-To-Plunge-Lower-.jpg?resize=1024,600\" \/>\n<meta name=\"author\" content=\"Crypto Magazine\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@cryptomagz\" \/>\n<meta name=\"twitter:site\" content=\"@cryptomagz\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Crypto Magazine\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=40182#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=40182\"},\"author\":{\"name\":\"Crypto Magazine\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#\\\/schema\\\/person\\\/f749cd846c4f13ef717c12a20ce9d040\"},\"headline\":\"\u2018Six Months in the Making\u2019: Drift Protocol Says $285,000,000+ Hack Involved North Korean-Backed Impostors at Multiple Crypto Conferences\",\"datePublished\":\"2026-04-06T18:41:27+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=40182\"},\"wordCount\":556,\"image\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=40182#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/Altcoins-To-Plunge-Lower-ahBLh3.jpg\",\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=40182\",\"url\":\"https:\\\/\\\/cryptomag.finance\\\/?p=40182\",\"name\":\"\u2018Six Months in the Making\u2019: Drift Protocol Says $285,000,000+ Hack Involved North Korean-Backed Impostors at Multiple Crypto Conferences - Cryptomag\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=40182#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=40182#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/Altcoins-To-Plunge-Lower-ahBLh3.jpg\",\"datePublished\":\"2026-04-06T18:41:27+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#\\\/schema\\\/person\\\/f749cd846c4f13ef717c12a20ce9d040\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=40182#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/cryptomag.finance\\\/?p=40182\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=40182#primaryimage\",\"url\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/Altcoins-To-Plunge-Lower-ahBLh3.jpg\",\"contentUrl\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/Altcoins-To-Plunge-Lower-ahBLh3.jpg\",\"width\":1024,\"height\":600},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=40182#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/cryptomag.finance\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u2018Six Months in the Making\u2019: Drift Protocol Says $285,000,000+ Hack Involved North Korean-Backed Impostors at Multiple Crypto Conferences\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#website\",\"url\":\"https:\\\/\\\/cryptomag.finance\\\/\",\"name\":\"Cryptomag\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/cryptomag.finance\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#\\\/schema\\\/person\\\/f749cd846c4f13ef717c12a20ce9d040\",\"name\":\"Crypto Magazine\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g\",\"caption\":\"Crypto Magazine\"},\"sameAs\":[\"https:\\\/\\\/cryptomag.finance\",\"https:\\\/\\\/x.com\\\/cryptomagz\"],\"url\":\"https:\\\/\\\/cryptomag.finance\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"\u2018Six Months in the Making\u2019: Drift Protocol Says $285,000,000+ Hack Involved North Korean-Backed Impostors at Multiple Crypto Conferences - Cryptomag","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptomag.finance\/?p=40182","og_locale":"en_US","og_type":"article","og_title":"\u2018Six Months in the Making\u2019: Drift Protocol Says $285,000,000+ Hack Involved North Korean-Backed Impostors at Multiple Crypto Conferences - Cryptomag","og_description":"The recent $285 million hack on the Solana-based DeFi platform Drift Protocol wasn\u2019t any run-of-the-mill exploit. Drift Protocol says in a new incident update that the April 1st attack was the result of six months of careful manipulation from North Korean-backed impostors. \u201cIn or about Fall 2025, Drift contributors were approached by a group of […]","og_url":"https:\/\/cryptomag.finance\/?p=40182","og_site_name":"Cryptomag","article_published_time":"2026-04-06T18:41:27+00:00","og_image":[{"url":"https:\/\/dailyhodl.com\/wp-content\/uploads\/2023\/05\/Altcoins-To-Plunge-Lower-.jpg?resize=1024,600","type":"","width":"","height":""}],"author":"Crypto Magazine","twitter_card":"summary_large_image","twitter_creator":"@cryptomagz","twitter_site":"@cryptomagz","twitter_misc":{"Written by":"Crypto Magazine","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/cryptomag.finance\/?p=40182#article","isPartOf":{"@id":"https:\/\/cryptomag.finance\/?p=40182"},"author":{"name":"Crypto Magazine","@id":"https:\/\/cryptomag.finance\/#\/schema\/person\/f749cd846c4f13ef717c12a20ce9d040"},"headline":"\u2018Six Months in the Making\u2019: Drift Protocol Says $285,000,000+ Hack Involved North Korean-Backed Impostors at Multiple Crypto Conferences","datePublished":"2026-04-06T18:41:27+00:00","mainEntityOfPage":{"@id":"https:\/\/cryptomag.finance\/?p=40182"},"wordCount":556,"image":{"@id":"https:\/\/cryptomag.finance\/?p=40182#primaryimage"},"thumbnailUrl":"https:\/\/cryptomag.finance\/wp-content\/uploads\/Altcoins-To-Plunge-Lower-ahBLh3.jpg","inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/cryptomag.finance\/?p=40182","url":"https:\/\/cryptomag.finance\/?p=40182","name":"\u2018Six Months in the Making\u2019: Drift Protocol Says $285,000,000+ Hack Involved North Korean-Backed Impostors at Multiple Crypto Conferences - Cryptomag","isPartOf":{"@id":"https:\/\/cryptomag.finance\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptomag.finance\/?p=40182#primaryimage"},"image":{"@id":"https:\/\/cryptomag.finance\/?p=40182#primaryimage"},"thumbnailUrl":"https:\/\/cryptomag.finance\/wp-content\/uploads\/Altcoins-To-Plunge-Lower-ahBLh3.jpg","datePublished":"2026-04-06T18:41:27+00:00","author":{"@id":"https:\/\/cryptomag.finance\/#\/schema\/person\/f749cd846c4f13ef717c12a20ce9d040"},"breadcrumb":{"@id":"https:\/\/cryptomag.finance\/?p=40182#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptomag.finance\/?p=40182"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptomag.finance\/?p=40182#primaryimage","url":"https:\/\/cryptomag.finance\/wp-content\/uploads\/Altcoins-To-Plunge-Lower-ahBLh3.jpg","contentUrl":"https:\/\/cryptomag.finance\/wp-content\/uploads\/Altcoins-To-Plunge-Lower-ahBLh3.jpg","width":1024,"height":600},{"@type":"BreadcrumbList","@id":"https:\/\/cryptomag.finance\/?p=40182#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptomag.finance\/"},{"@type":"ListItem","position":2,"name":"\u2018Six Months in the Making\u2019: Drift Protocol Says $285,000,000+ Hack Involved North Korean-Backed Impostors at Multiple Crypto Conferences"}]},{"@type":"WebSite","@id":"https:\/\/cryptomag.finance\/#website","url":"https:\/\/cryptomag.finance\/","name":"Cryptomag","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptomag.finance\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptomag.finance\/#\/schema\/person\/f749cd846c4f13ef717c12a20ce9d040","name":"Crypto Magazine","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g","caption":"Crypto Magazine"},"sameAs":["https:\/\/cryptomag.finance","https:\/\/x.com\/cryptomagz"],"url":"https:\/\/cryptomag.finance\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/posts\/40182","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=40182"}],"version-history":[{"count":0,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/posts\/40182\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/media\/40183"}],"wp:attachment":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=40182"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=40182"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=40182"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}