Drift Attributes April Exploit to North Korean Social Engineering Campaign

Drift has linked its April 1 exploit, which resulted in the loss of approximately $280 million, to a six-month social engineering campaign allegedly conducted by North Korean actors. According to NS3.AI, the Solana-based perpetuals exchange revealed that the relationship with the suspected group began in the fall of 2025. Individuals posing as a quant trading firm approached Drift contributors at a major crypto conference during this period. The group reportedly onboarded an Ecosystem Vault and deposited over $1 million of its own capital. Drift explained that the exploit was executed using durable nonces rather than exploiting a smart contract vulnerability. Meanwhile, Mandiant has not yet formally attributed the attack, as device forensics are still pending.