Blockchain analytics agency Elliptic says the $286 million exploit of Solana-based Drift Protocol is almost certainly linked to the Democratic Folks’s Republic of Korea (DPRK).
Solana Suffered One Of The Largest Crypto Exploits In Historical past
On April 1st, the DEX Drift Protocol suffered a serious exploit that drained virtually $300 million {dollars} in crypto belongings from its core vaults. The alternate reported on it on its official X account because it was nonetheless present process:
Drift Protocol is experiencing an lively assault. Deposits and withdrawals have been suspended. We’re coordinating with a number of safety corporations, bridges, and exchanges to comprise the incident. This isn’t an April Fools joke. We’ll present extra updates from this account as… https://t.co/03SRPq4fHj
— Drift (@DriftProtocol) April 1, 2026
The raid unfolded in below 20 minutes, with roughly $286 million siphoned off throughout a basket of belongings from shut to twenty vaults. Drift is the biggest decentralized perpetual futures alternate on Solana. That is the most important crypto exploit seen up to now in 2026 and ranks among the many largest on document, edging out the $235 million WazirX breach.
Drift’s complete worth lock (TVL) collapsed from roughly $550 million to below $250 million after the assault. The workforce’s emergency response consisted of pausing deposits and withdrawals and coordinating with safety corporations and exchanges.
The protocol shared the main points of the incident in a while, claiming it was a “a extremely refined operation that seems to have concerned multi-week preparation and staged execution”. Past that, the alternate’s official channels kept away from attributing tasks.
Earlier at the moment, a malicious actor gained unauthorized entry to Drift Protocol by way of a novel assault involving sturdy nonces, leading to a fast takeover of Drift’s Safety Council administrative powers.
This was a extremely refined operation that seems to have concerned…
— Drift (@DriftProtocol) April 2, 2026
Now, the analytics agency Elliptic has launched an investigation claiming the on‑chain conduct, laundering strategies, and community‑stage indicators match the strategies seen in prior DPRK‑linked operations, making this not simply one other DeFi rug, however a suspected state‑sponsored assault.
The North Korean Hackers Strike Once more
Ledger CTO Charles Guillement additionally linked Drift’s assault methodology to Bybit’s $1.4 billion hack, which was attributed to North Korean hacking teams. NewsBTC’s sister web site Bitcoinist reported on this yesterday.
Drift Protocol, one of many main perpetual DEXs on Solana, has been hacked for about $213M. This makes it the most important hack of 2026 up to now, and one of many largest ever on the Solana blockchain, proper behind the Wormhole Bridge exploit of 2022.
The total particulars of the…
— Charles Guillemet (@P3b7_) April 2, 2026
In keeping with Elliptic, the attacker doubtless compromised Drift’s administrator personal keys, gaining privileged management over withdrawals and key parameters. The assault systematically drained three essential vaults: JLP Delta Impartial, SOL Tremendous Staking and BTC Tremendous Staking, together with a single $41.7 million JLP switch value about $155 million.
Elliptic traced the stolen funds and concluded that the attacker created the pockets roughly eight days earlier than the exploit and even acquired a small check switch from a Drift vault. This implies a pre‑deliberate, staged operation somewhat than a smash‑and‑seize.
Elliptic Investigator’s graphic displaying the circulation of funds from the preliminary exploit on Solana by way of to the attacker’s present holdings on Ethereum. Supply: Elliptic.
After the exploit was accomplished, the attacker used Jupiter, a Solana DEX aggregator, to swap the stolen tokens into USDC, bridged funds to Ethereum, after which rotated into ETH and different belongings throughout a number of wallets.
Such cross‑chain laundering patterns, obfuscation strategies, and community‑stage indicators match strategies seen in prior DPRK‑attributed assaults, Elliptic claims. If formally confirmed, this may be the 18th such operation with over $300 million stolen already.
Confirmed or not, there isn’t any denying that state‑linked actors are systematically focusing on liquidity‑wealthy crypto protocols to fund North Korea’s weapons packages. Let’s not overlook that the North Korea‑affiliated Lazarus Group has funneled billions of {dollars} in stolen cash by way of cryptocurrency networks.
Elliptic has already clustered all attacker‑linked token accounts on Solana and Ethereum so exchanges and protocols can display towards contaminated funds in close to actual time.
The hack will doubtless harden scrutiny of Solana DeFi governance, admin key design, and multisig safety, even because the ecosystem continues to chase institutional‑grade perps liquidity.
For the time being of writing, SOL trades for $80 on the each day chart. Supply: SOLUSD on Tradingview.
Cowl picture from Perplexity. SOLUSD chart from Tradingview.
Editorial Course of for bitcoinist is centered on delivering totally researched, correct, and unbiased content material. We uphold strict sourcing requirements, and every web page undergoes diligent evaluation by our workforce of high know-how specialists and seasoned editors. This course of ensures the integrity, relevance, and worth of our content material for our readers.
