Drift: The April 1st attack was part of a long-term infiltration operation planned by a North Korean hacking group.

Drift Protocol announced on the X platform that its preliminary investigation into the April 1, 2026 attack indicates that the operation was orchestrated by the North Korean government-backed hacking group UNC4736 (also known as AppleJeus or Citrine Sleet). From the fall of 2025, this group engaged in face-to-face interactions with Drift contributors for six months, using methods such as sending intermediaries to crypto conferences and establishing fake quantitative trading companies, to induce them to download malicious code libraries or applications. Drift has currently frozen all protocol functions and removed compromised wallets from multi-signature systems. Mandiant has been invited to participate in an in-depth forensic investigation. The investigation confirms that the on-chain fund flows used to test the operation can be traced back to the Radiant Capital attackers in October 2024.