Ledger CTO: Drift attack methods are similar to the 2025 Bybit incident, and may involve North Korean hackers.

Charles Guillemet, CTO of Ledger, stated that the attack method used in this Drift Protocol exploit is similar to the 2025 Bybit hack, which is widely believed to be linked to North Korean hackers. He pointed out that this attack did not directly target smart contracts, but rather involved long-term infiltration of multi-signature signer devices, inducing them to approve malicious transactions. These signers may have unknowingly completed the authorization. Guillemet believes that this incident exposes security vulnerabilities primarily stemming from personnel and operational flaws, rather than code-level defects.