Complete forensic reconstruction of the largest DeFi hack of 2026. On-chain data, fund flow tracing, attribution analysis, and vulnerability assessment.
On April 1, 2026 at 16:05 UTC, threat actors attributed to North Korea's Lazarus Group (UNC4736 / Citrine Sleet / AppleJeus) executed a $285 million exploit against Drift Protocol, the largest decentralized perpetual futures exchange on Solana.
The attack was the culmination of a 6-month state-sponsored intelligence operationinvolving human intelligence (HUMINT), social engineering, malware delivery, and sophisticated on-chain staging. The attackers compromised 2 of 5 signers on Drift's Security Council multisig, used durable nonce transactions to pre-sign admin authority transfers, created a fabricated token (CarbonVote / CVT) with a manipulated oracle, disabled withdrawal safety limits, and drained 15+ asset types from protocol vaults in 31 transactions over approximately 12 minutes.
Stolen funds were swapped to USDC via Solana DEXs, bridged to Ethereum via Circle's CCTP over a 6-hour window, and converted to approximately 129,066 ETH (~$267M). This is the largest DeFi hack of 2026, the second-largest in Solana history, and reportedly the 18th DPRK-attributed crypto operation in 2026.
Every red flag was documented before the attack
OtterSec published a detailed warning about durable nonce risks on February 22, 2025 — over 13 months before the exploit. Oracle manipulation is a known pattern (Mango Markets, 2022). 2/5 multisig thresholds are known-weak. The tooling gap was the problem, not the knowledge gap.
Attack Timeline
Phase 0 — Reconnaissance & Social Engineering
Fall 2025
Operatives approach Drift contributors at conferences
Pose as employees of a 'legitimate quantitative trading firm.' Start of 6-month HUMINT campaign.
Fall 2025 – Mar 2026
Build credibility with >$1M in legitimate capital
Establish Telegram group, conduct working sessions, onboard Ecosystem Vault.
Phase 1 — Infrastructure Staging
Mar 11, ~00:00 UTC
10 ETH withdrawn from Tornado Cash
09:00 Pyongyang time — DPRK timezone indicator. Initial operational funding.
Mar 12
CarbonVote Token (CVT) deployed on Solana
Mint: G84LEh...QKo. CVT deployment at ~09:30 Pyongyang time — second timezone indicator.
Mar 12–22
CVT liquidity seeded on Raydium (~$500); wash trading begins
Establishes artificial ~$1 price on DexScreener over 10 days.
A Drift contributor cloned an external code repository that exploited a known vulnerability in VSCode/Cursor IDE. The repository likely contained a crafted .vscode/settings.json or extension configuration that executed arbitrary code upon opening the project.
VECTOR 2TestFlight Malware
Another contributor downloaded a TestFlight application presented as the trading firm's proprietary “wallet product.” The iOS app contained a malicious payload that likely exfiltrated signing credentials or installed a persistent backdoor.
Key Insight — Adaptation to Multisig Rotation
When Drift migrated its Security Council on March 27 (swapping out a member), the attacker adapted within 3 days. By March 30, a new durable nonce account appeared tied to a member of the updatedmultisig. This demonstrates the attacker had compromised at least 3 individuals (to maintain 2/5 access across the rotation) and had real-time visibility into Drift's governance operations.
Cold Wallet Limitation
Drift confirmed “no seed phrases have been compromised.” All signers used hardware wallets. The attacker compromised the people and their computing environments, not the keys directly.
Previous DPRK Operations (Same Methodology)
2022Ronin Bridge
$625MValidator key compromise
2022Wormhole
$326MSignature verification bypass
2024Radiant Capital
~$50MSocial engineering + multisig
2025Bybit
$1,400MSigner compromise + rapid bridging
2026Drift Protocol
$285MSocial eng. + durable nonce + oracle
CarbonVote Token (CVT) — Fabricated Collateral
Mint Address
G84LEh...QKo
Decimals
9
Total Supply
~750,000,000
Backing Liquidity
~$500
Mint Authority
Revoked (null)
Freeze Authority
Revoked (null)
Oracle Manipulation Mechanics
▶
Created a completely fabricated SPL token with zero intrinsic value
▶
Seeded Raydium liquidity pool with ~$500
▶
Wash trading over 10 days established artificial ~$1 price on DexScreener
ETH conversionEthereum DEX swaps~129,066 ETH~8 hours
Cross-Chain Infrastructure
Tornado CashOrigin funding obfuscation10 ETH (seed)
NEAR IntentsCross-chain funding to Solana1 SOL
Circle CCTPPrimary bridge (USDC burn/mint)$232M+
WormholeSecondary bridgePartial
deBridgeSecondary bridgePartial
ChainFlipPost-bridge swapsUnknown
BackpackExchangeUnknown
MayanAuxiliary bridgePartial
JupiterSolana DEX aggregatorMajority of swaps
HyperLiquidExchange depositSOL portion
BinanceCEX depositPartial
Circle USDC Freeze Controversy
$232M in stolen USDC flowed through Circle's own CCTP unblocked
Over a 6-hour window during US business hours, the attacker bridged $232M+ in stolen USDC from Solana to Ethereum via Circle's Cross-Chain Transfer Protocol. Circle did not deploy its USDC blacklist/freeze authority at any point during this window. The attacker deliberately chose USDC over USDT, presumably betting Circle would be slower to act.
“Circle was asleep while many millions of USDC were swapped via CCTP from Solana to Ethereum for hours from the 9-figure Drift hack during US hours” — ZachXBT
The Contradiction
Just 9 days earlier (March 23), Circle froze 16 legitimate business hot wallets — including exchanges, casinos, and the DFINITY Foundation's ckETH Minter contract — as part of a civil case. ZachXBT called it “potentially the single most incompetent freeze” in five years and documented $420M+ in alleged compliance failures by Circle since 2022.
Attribution — DPRK / Lazarus Group
TRM Labs
Likely DPRK
Elliptic
Consistent with DPRK
Mandiant
Investigation ongoing
Attribution Evidence
01 Tornado Cash pre-funding — consistent with DPRK operational playbook
02 Pyongyang timezone alignment — CVT deployed at 09:00/09:30 local time
03 6-month social engineering campaign — identical to Radiant Capital (Oct 2024)
04 VSCode/Cursor exploit + TestFlight malware — consistent with known DPRK tooling
06 On-chain fund tracing links to same actors behind Radiant Capital breach
07 State-level resources — >$1M invested in credibility building
08 18th DPRK-attributed crypto operation in 2026 (Elliptic)
Vulnerability Analysis
CRITICAL
2/5 Multisig Threshold with Zero Timelock
Only 2 signatures needed for any action including admin transfers. Zero timelock means instant execution. Compromising 2 individuals gave complete control with no detection window.
CRITICAL
Durable Nonce Abuse (Warned 13 Months Prior)
OtterSec published detailed warning on February 22, 2025. The exact attack vector used in this exploit was publicly documented. No ecosystem tooling existed to surface the risk to signers.
CRITICAL
Blind Signing Problem
Multisig signers presented with unreadable hex data. Cannot mathematically verify transaction outcome. OtterSec described it as 'roughly equivalent to blind signing.'
HIGH
Withdrawal Guards Modifiable Without Limits
Admin role could modify withdrawal guard thresholds by up to 100,000x in a single transaction with no timelock, maximum change limit, or separate governance approval.
HIGH
No Oracle Quality Checks for New Markets
New spot market listed with oracle backed by $500 in liquidity and 21-day price history. No minimum liquidity, feed age, or gradual collateral ramp-up requirements.
MEDIUM
Social Engineering Susceptibility
Despite hardware wallets, contributors were vulnerable to IDE-based exploits and mobile malware delivered through 6 months of trust building.
TRM Labs — “North Korean Hackers Attack Drift Protocol in $285 Million Heist”
Elliptic — “Drift Protocol Exploited for $286M in Suspected DPRK-Linked Attack”
News Coverage
Bloomberg, CoinDesk, The Hacker News, BleepingComputer, Security Affairs, CCN, Benzinga
On-Chain Investigation
ZachXBT — real-time tracking and Circle accountability analysis
Arkham Intelligence — wallet labeling and fund flow tracking
Lookonchain — exploit alert and fund movement tracking
Solana RPC — live balance and transaction queries (api.mainnet-beta.solana.com)
This report will be updated as additional information becomes available from Mandiant's investigation, law enforcement actions, and on-chain fund movement tracking.
This attack was preventable with better tooling.
TxScope surfaces durable nonces, authority transfers, oracle manipulation, and every other red flag in this attack — before any signer approves.