Blockchain Analytics Firm Elliptic Attributes $286M Drift Hack to North Korean State-Sponsored Group

Elliptic attributed the $285 million Drift exploit to multiple hallmarks of North Korean state-sponsored hackers.

“North Koreans hackers likely behind $286 million Drift Protocol exploit: Elliptic The blockchain analytics firm pointed to cross-chain laundering patterns and Solana-specific tracing challenges that mirror prior North Korean state-linked operations”

@coindesk

The hack drained most of Drift's liquidity within an hour, reducing total value locked from about $550 million to below $250 million.

@coindesk

Drift confirmed a novel attack involving durable nonces, a legitimate Solana feature that allowed pre-signed transfers weeks before execution.

The exploit did not involve a code bug or stolen keys but hinged on social engineering.

Durable nonces were exploited to pre-sign transactions that remained valid for more than a week.

The attacker introduced a fake digital asset, seeded it with $500, and wash-traded it to fool price oracles.

ActuCrypto .info

The attack executed 31 transactions over roughly 12 minutes, draining real assets.

Elliptic noted pre-positioned wallets and structured laundering flow mirrored previous Lazarus Group operations.

This would mark the eighteenth DPRK act Elliptic tracked in 2026.

“Blockchain analytics firm Elliptic on Thursday flagged “multiple indicators” that North Korea’s state-sponsored hackers may be behind the $285 million exploit of Drift Protocol, the largest DeFi hack of 2026 so far that wiped out more than half of the Solana-based exchange’s total value locked”

Benzinga

North Korean hackers stole a record $2 billion in 2025, including the $1.4 billion Bybit breach.

The U.S. Treasury has linked stolen crypto assets to Pyongyang's weapons programs.

Drift's token dropped over 40% following the hack.

Drift said the incident was not a bug and no seed phrases were compromised.

The attack was enabled by pre-signed transactions and compromise of the approvals process.

bloomingbit

Drift is coordinating with security firms, bridges, exchanges, and law enforcement.

The exploit shows how social engineering is becoming a leading threat vector in DeFi.