On Sunday, Drift Protocol—a decentralized exchange based on Solana—revealed that an attack which siphoned approximately $285 million was a meticulously planned six-month operation by a North Korean state-affiliated threat group. The attackers assumed fake professional identities and engaged with contributors at in-person conferences using malicious developer tools to facilitate their breach, according to a detailed report from the platform.
Michael Pearl, Vice President of Strategy at blockchain security firm Cyvers, explained to Decrypt that “crypto teams are now facing adversaries who operate like intelligence units rather than mere hackers, leaving many organizations unprepared for such sophisticated threats.”
The group first engaged with contributors at a significant crypto conference last fall, posing as a quantitative trading firm interested in integrating with Drift’s protocol. Over time, they established trust through face-to-face meetings and Telegram communications, onboarded an Ecosystem Vault on Drift, deposited $1 million of their own capital into the vault, and then disappeared, erasing all traces of chats and malware when the exploit occurred.
Drift suggested that the intrusion might have involved a malicious code repository, a counterfeit TestFlight app, and a vulnerability in VSCode/Cursor allowing silent code execution without user interaction. The platform attributed the attack with “medium-high confidence” to UNC4736, also known as AppleJeus or Citrine Sleet—the same group linked to 2024’s Radiant Capital hack by cybersecurity firm Mandiant.
According to Drift, the individuals who met contributors in person were not North Korean nationals. DPRK-linked actors often rely on third-party intermediaries for face-to-face engagements. Onchain fund movements and overlapping identities suggest DPRK involvement, as noted by incident responders SEAL 911, although Mandiant is awaiting forensic confirmation.
Security researcher @tayvano_, credited by Drift for aiding in the identification of malicious actors, suggested that the implications extend beyond this incident. In a tweet, they alleged that “DPRK IT workers built the protocols you know and love, all the way back to defi summer.”
Pearl observed, “Drift and Bybit highlight the same pattern—signers were not directly compromised at the protocol level but tricked into approving malicious transactions.” He stressed that understanding transaction intent is more crucial than the number of signers.
He advocated for a shift in security to pre-transaction validation at the blockchain level, where transactions are independently simulated and verified before execution. “Once attackers control what users see, the only effective defense is validating what a transaction actually does, regardless of the interface,” Pearl added.
Regarding developer tools as an attack surface, Lavid emphasized that assumptions need to change fundamentally. He noted to Decrypt that it’s essential to assume endpoints are compromised, pointing out IDEs, code repositories, mobile apps, and signer environments as common entry points for attackers. “If these foundational tools are vulnerable, anything shown to the user—including transactions—can be manipulated,” he said, explaining this fundamentally challenges traditional security assumptions and leaves teams unable to trust the interface, device, or signing flow.