Morning Update: Alleged North Korean Hack on Drift Protocol for $285M

Tyler Warner’s Morning Minute newsletter offers daily insights and opinions, which may not align with those of Decrypt. Also available is our concise daily news show, accessible via Apple Podcasts or Spotify.

On April 1st, the largest decentralized perpetual exchange on Solana, Drift Protocol, was breached for a staggering $285 million. Subsequent revelations indicate this was a meticulously planned governance attack that unfolded over 12 minutes, involving 31 rapid transactions. The scheme began in October 2025 when attackers posing as a quantitative trading firm infiltrated Drift at a significant crypto conference. Over six months, they established genuine connections with protocol insiders across various events. Eventually, leveraging these relationships, they manipulated multisig signers into pre-approving concealed transactions via Solana’s durable nonces feature, which allowed for dormant authorizations. The attackers further created and promoted a counterfeit token (CarbonVote/CVT) through seed liquidity and wash trading, deceiving Drift’s price oracles to recognize it as valid collateral worth millions.

Both Elliptic and TRM Labs have identified DPRK involvement in this attack, marking the 18th suspected North Korean crypto incursion of 2026, with over $300 million stolen to date. Meanwhile, Charles Schwab announced plans to introduce spot Bitcoin and Ethereum trading later this quarter, integrating these assets into their existing platform that manages $12.2 trillion in client assets. Unlike ETFs, Schwab clients will directly own the cryptocurrencies through Premier Bank. The rollout is phased: employees first, then invited clients, followed by full public access.

Google recently published research indicating quantum computers could potentially break elliptic curve cryptography, fundamental to Bitcoin and Ethereum, with 20 times fewer qubits than previously assumed. Although necessary hardware isn’t yet available, the feasibility threshold has dropped significantly. The study involved consultation with U.S. authorities and utilized zero-knowledge proofs for external validation of resource estimates without revealing attack specifics.

Ethereum Foundation researcher Justin Drake, a late co-author on the paper, estimated at least a 10% chance that by 2032, a quantum computer could deduce a Bitcoin private key from an exposed public one. Additionally, Coinbase secured conditional approval for a national trust bank charter from the Office of the Comptroller of the Currency (OCC). This does not convert Coinbase into a bank but offers it federal regulatory consistency for asset custody across all states, replacing varied state regulations and easing institutional client operations.

The OCC’s decision allows Coinbase to be governed by one federal regulator rather than multiple state regimes. However, traditional banks like ICBA and BPI oppose this move, arguing it oversteps the OCC’s legal authority. Circle is entering the wrapped Bitcoin market with cirBTC, a token backed 1:1 by on-chain Bitcoin reserves, launching initially on Ethereum mainnet and Arc blockchain. Circle VP Rachel Mayer suggests that skepticism around existing wrappers has sidelined Bitcoin from DeFi, despite interest in yield and liquidity. With WBTC facing scrutiny over custody issues, Circle leverages its credibility in backing USDC to introduce cirBTC, aiming at both institutional clients and broader markets.