$270M Solana hack exposes North Korean operation

TLDR

A roughly $270 to $285 million exploit of Solana-based Drift Protocol is now attributed by investigators to a months long North Korean state-backed operation.

1. Drift Protocol on Solana was drained of about $270M on 1 April 2026 using compromised admin powers rather than a smart contract bug.
2. Blockchain analytics firms link the attacker to North Korean group UNC4736, tying the stolen funds to a broader DPRK crypto theft campaign.
3. The incident exposes serious governance and operational security weaknesses across Solana DeFi that other protocols are now urgently reassessing.

Deep Dive

1. How The Exploit Worked

Drift Protocol, a major perpetual futures DEX on Solana, lost around $270 to $286 million in under 20 minutes on 1 April 2026, affecting nearly 20 vaults and collapsing TVL from about $550M to under $250M according to detailed post mortems.

Drift says this was not a smart contract bug. The attackers gained Security Council admin control and abused Solana durable nonces, which let them pre sign transactions and later execute them to drain vaults in one burst.

The compromise itself came from off chain vectors: a malicious TestFlight wallet app and a known vulnerability in VSCode/Cursor files that allowed code execution on contributors machines, giving the attackers enough keys to approve malicious governance actions.

2. Linking It To North Korea

Blockchain analytics firm Elliptic and other investigators report that on chain flows and laundering patterns match previous Democratic Peoples Republic of Korea (DPRK) operations, particularly those associated with the Lazarus aligned cluster UNC4736 as covered in independent analyses.

Funds were quickly swapped into USDC on Solana, bridged to Ethereum, and rotated into ETH and other assets across many wallets, mirroring earlier DPRK linked hacks. US and allied governments have repeatedly said such stolen crypto is used to fund North Koreas weapons programs.

Attribution is still framed as likely by private firms, but it fits a wider pattern, with this hack counted as roughly the eighteenth DPRK linked crypto theft in the current tracking period.

3. Impact On Solana And DeFi

The exploit hit not only Drift but also at least 20 Solana protocols that integrated its vaults or liquidity, turning a governance failure in one protocol into a multi project solvency shock across the ecosystem.

Solana leaders emphasize that the base chain and Drifts core contracts held up, with the real weakness in admin key design, multisig device security, and human focused social engineering at conferences and over months of interaction.

Confidence: high on exploit mechanics, moderate on North Korean attribution because it relies on private analytics that governments have not yet fully formalized in public sanctions.

Conclusion

The Drift exploit shows how a patient, intelligence style operation can turn human trust and governance shortcuts into a $270M class loss that ripples across an entire DeFi ecosystem.

If the North Korean link continues to firm up, regulators and exchanges are likely to tighten screening and sanctions around Solana DeFi flows, while protocols are pushed to redesign multisigs, admin powers, and device security to withstand state level attackers.