‘Six Months in the Making’: Drift Protocol Says $285,000,000+ Hack Involved North Korean-Backed Impostors at Multiple Crypto Conferences

The recent $285 million hack on the Solana-based DeFi platform Drift Protocol wasn’t any run-of-the-mill exploit.

Drift Protocol says in a new incident update that the April 1st attack was the result of six months of careful manipulation from North Korean-backed impostors.

“In or about Fall 2025, Drift contributors were approached by a group of individuals at a major crypto conference who presented as a quantitative trading firm looking to integrate on the protocol. It is now understood that this appears to be a targeted approach, where individuals from this group continued to deliberately seek out and engage specific Drift contributors, in person, at multiple major industry conferences in multiple countries over the following six months.

They were technically fluent, had verifiable professional backgrounds, and were familiar with how Drift operated. A Telegram group was established upon the first meeting, and what followed were months of substantive conversations around trading