$280M Drift Hack Linked to Suspected North Korean Attack Using Novel Solana Exploit

• Attackers drained approximately US$280 million from Drift Protocol on April 1, exploiting Solana’s durable nonce feature to pre-sign malicious transactions weeks in advance and seize security council control.
• Three protocol vaults were emptied, including approximately 41.7 million JLP tokens worth roughly US$155 million, before stolen funds were rapidly swapped to USDC and bridged to Ethereum.
• Blockchain analytics firm Elliptic identified multiple on-chain indicators consistent with North Korean state tradecraft.

Drift Protocol, Solana’s largest decentralised perpetual futures exchange, lost approximately US$280 million (AU$400 million) on April 1 after attackers exploited a novel Solana feature to pre-approve malicious admin transactions weeks in advance, seizing security council control and draining three protocol vaults.

Blockchain analytics firm Elliptic flagged the operation as a suspected North Korean state attack.

Drift Protocol held approximately US$550 million (AU$843 million) in total value locked (TVL) before the attack. That figure collapsed to under US$250 million (AU$383 million) within hours of the exploit. 

As collateral, SOL’s spot price dropped roughly 9% to approximately US$78.60 (AU$120.40), marking the second-largest Solana exploit on record after the Wormhole bridge attack of 2022, which drained US$326 million (AU$499 million).

Read more: Bitrefill Hack Exposes Wallets and Gift Card Systems as North Korean Links Emerge

Not An April Fools’ Joke

Crypto News Australia reported how Drift acknowledged the breach in real time.

We are observing unusual activity on the protocol. We are currently investigating. Please do not deposit funds into the protocol while we investigate. This is not an April Fools joke.

Drift Protocol

Blockchain analytics firm Elliptic attributed the attack to North Korean-linked actors, citing transaction patterns, laundering methods, and network signatures consistent with prior operations. 

The firm estimated total losses at US$286 million (AU$415 million) and said the incident was the 18th suspected DPRK-linked crypto attack in 2026. Year-to-date, such groups have stolen more than US$300 million (AU$435 million).

North Korean-linked actors stole about US$2 billion (AU$2.9 billion) in crypto in 2025, representing roughly 60% of global theft that year. Across all recorded operations, cumulative losses exceed US$6.5 billion (AU$9.43 billion), funds the U.S. government has linked to weapons development programs.

The Drift exploit is one of the largest decentralised finance breaches to date, following the US$1.5 billion (AU$2.18 billion) Bybit hack in 2025.

Related: Man Charged in Crypto Exchange Hacks Faces Up to 30 Years

The post $280M Drift Hack Linked to Suspected North Korean Attack Using Novel Solana Exploit appeared first on Crypto News Australia.