"The preliminary investigation shows that Drift experienced a structured intelligence operation requiring organizational backing, significant resources, and months of deliberate preparation"

A six month social engineering operation.

Drift Protocol - incident background update

Drift Protocol said its preliminary investigation points to a structured intelligence operation behind the April 1, 2026 incident, one that required organizational backing, significant resources, and months of preparation. The update says attackers began approaching Drift contributors in fall 2025 at a major crypto conference while posing as a quantitative trading firm, then continued meeting specific contributors in person across multiple countries over the next six months. Drift said the operation may have used multiple social-engineering paths, including a cloned code repository, a malicious TestFlight app, and a possible editor-based code-execution vulnerability tied to VSCode/Cursor. The background matters because this was not framed as a simple smart-contract bug: reporting from Drift and security firms says the attackers used social engineering and privileged access to drain about $285 million to $286 million from the protocol in minutes. Multiple investigations have linked the campaign to UNC4736, a North Korean state-affiliated threat group also tracked as AppleJeus or Citrine Sleet, and Drift said its own update was supported by SEAL 911 investigators. The incident also triggered recovery and containment measures, including freezing remaining protocol functions, removing compromised wallets from the multisig, flagging attacker wallets across exchanges and bridge operators, and working with law enforcement and forensic partners.

✨ AI-generated background, compiled from web sources — not editorial content.

More coverage

• Drift Protocol exploited for $286 million in suspected DPRK ... - Elliptic (elliptic.co)
• Drift Protocol: Incident Report - Nexus Mutual (nexusmutual.io)
• Drift (@DriftProtocol) on X (x.com)
• Incident Recovery Update – April 16, 2026 - Drift Trade (drift.trade)
• Drift Protocol Exploit: Why “Social Trust” Is the Newest Cybersecurity ... (crowell.com)

Explore the topic

• Social Engineering
• update
• Exploit