Drift Says $285M Drain Was a Six-Month North Korean Infiltration

Solana-based decentralized exchange Drift Protocol says the attack that drained roughly $285 million from its platform was not a snap exploit but a structured, six-month intelligence operation run by a North Korean state-affiliated threat group, according to a detailed incident update the protocol published Sunday and reported by Decrypt (Oct. 29).

Per Drift's own account, the attackers built fabricated professional identities, met contributors in person at industry conferences, and deployed malicious developer tools to compromise people with access before executing the drain. In other words, the technical exploit was the last step; the groundwork was social. Drift attributes the operation to a North Korean state-affiliated group, though the update stops short of naming it.

The hack surfaced in the same Decrypt report as a separate U.S. Treasury action: sanctions against 11 individuals and entities tied to a North Korean IT-worker scheme that Treasury says moved millions in crypto. Decrypt's body text details only the Drift incident; specifics of the Treasury designations — who was named, which networks, how the two threads connect — weren't laid out, so treat the sanctions as a related headline rather than a confirmed link to the Drift drain.

Key facts

• Amount drained: roughly $285 million from Drift Protocol — figure stated by Drift in its incident update (via Decrypt, Oct. 29, 2026).
• Timeline: a described six-month operation preceding the drain; Drift published its update on Sunday (Oct. 25) — Drift / Decrypt.
• Method: fabricated identities, in-person conference meetings, and malicious developer tools used to compromise contributors — Drift incident update.
• Attribution: a North Korean state-affiliated threat group, per Drift; the group is not named in the update.
• Separately: U.S. Treasury sanctioned 11 people and entities over a North Korean IT-worker scheme that moved crypto — Decrypt headline; details not provided in the body.

The real-world read

Nearly everything here traces to one place: Drift's own incident report. The dollar figure, the six-month framing, and the North Korea attribution are the victim's account of an attack on itself — not an independent forensic finding, an on-chain analysis from a third party, or a law-enforcement confirmation. That doesn't make it wrong; state-linked social-engineering campaigns against crypto firms are well-documented. But a self-published post-mortem is also where a protocol controls the narrative, and the "sophisticated six-month nation-state operation" framing is the version of events most favorable to a team explaining how contributors got compromised.

Two cautions. First, the $285 million is a single source and unverified against on-chain data here — a range or confirmation would need the transaction trail. Second, the Treasury sanctions and the Drift hack are presented side by side but not shown to be the same operation; don't assume the 11 designees are Drift's attackers absent that link.

This is news, not financial advice.

Sources

• Decrypt (Oct. 29, 2026) — secondary reporting; relayed Drift Protocol's incident update, the ~$285M figure, the six-month-operation framing, and the separate Treasury sanctions headline. The attack narrative originates with Drift Protocol's own incident update (primary, but an interested party describing an attack on itself).