North Korea-linked hack drains $285M from DeFi

TLDR

A Solana-based DeFi protocol, Drift Protocol (DRIFT), was exploited for about $285 million in early April in an attack widely attributed to North Korean state-backed hackers.

1. Hackers infiltrated Drift for months, then used Solana features and admin privileges to drain roughly $280285 million in one of DeFis largest exploits this year.
2. The hack cratered Drifts TVL, sparked at least a dozen follow-on attacks, and triggered a class action against USDC issuer Circle over its response while Tether stepped in with a large recovery package.
3. The incident highlights a broader trend of North Korean operatives infiltrating crypto teams, and it may reshape expectations for DeFi security and stablecoin issuers responsibilities.

Deep Dive

1. How The $285M Drift Exploit Worked

On April 1, attackers drained about $285 million from Solana-based derivatives DEX Drift Protocol in a fast, coordinated exploit, wiping out more than half of its total value locked (TVL) in minutes. Reports describe a months-long operation where a North Korean state-linked group posed as a quantitative trading firm, embedded itself inside Drift, and abused pre-signed administrative transfers using Solana durable nonces to seize control and execute the drain.Drift Protocol's $285 Million Exploit

Blockchain analytics firm Elliptic and other investigators link the attack to North Korean state-sponsored actors, fitting a pattern where DPRK groups focus on fewer but much larger thefts; Chainalysis has estimated around $2 billion in crypto stolen by such actors in 2025 alone.Drift exploit attribution

2. Fallout For Drift, DeFi, And Stablecoins

Drifts TVL reportedly fell from around $550 million to under $250 million, and at least a dozen other protocols and crypto businesses have been attacked in the weeks since, underscoring a wider wave of opportunistic exploits.Post-Drift attack wave

A key controversy is how stablecoin issuers responded. Hackers converted roughly $270232 million of stolen assets into USDC and bridged them from Solana to Ethereum via Circles Cross-Chain Transfer Protocol over about eight hours.USDC flows detail A class action lawsuit alleges Circle should have frozen these funds faster, while Circle argues it only freezes assets when legally required.Circle lawsuit summary

In contrast, Tether has committed up to about $127.5 million in support and other facilities as part of Drifts recovery plan, and Drift is relaunching with USDT as its primary settlement asset.Tether-backed recovery plan

3. North Korean Infiltration And What To Watch

The incident fits a broader picture of North Korean infiltration of crypto projects. An Ethereum Foundationfunded investigation recently reported about 100 DPRK-linked IT workers embedded in 53 crypto teams, often using fake identities and long-term contributions to gain sensitive access.DPRK developer infiltration

In Drifts case, human compromise and governance design were central, not just code bugs. Going forward, key things to watch include: tighter role-based access and multisig controls at DeFi projects, stronger hiring and operational security, and whether regulators push stablecoin issuers to intervene more proactively in similar exploits.

Conclusion

The $285 million Drift Protocol hack shows how sophisticated, state-linked actors can combine social engineering, protocol design quirks, and cross-chain infrastructure to drain large DeFi platforms. It is accelerating pressure on teams to harden governance and operational security, and it is forcing a reassessment of how much users can rely on stablecoin issuers as a backstop when large exploits occur.