cryptocurrency-platform-riskidentity-impersonation-frauddata-exfiltration-methodinitial-access-method

Drift Protocol exploit drained $280M after months-long social engineering campaign

Emerging Technology Risk · 5 sources · Updated 4mo ago · First seen May 25, 2026

Drift Protocol, a Solana-based decentralized trading platform, said attackers stole about $280 million to $285 million after a months-long intrusion culminated in the takeover of administrative control and the draining of protocol vaults in roughly 12 minutes. Drift’s preliminary findings said the operation abused Solana’s durable nonce feature and pre-signed transactions rather than a simple smart contract flaw, while investigators reported that the attackers staged activity weeks in advance, created a fake asset called CarbonVote Token (CVT), and manipulated its trading history so protocol oracles would accept it as collateral. The stolen assets were then swapped largely into USDC and SOL, bridged to Ethereum through Circle’s Cross-Chain Transfer Protocol, and moved onward through additional services and exchanges.

New surface, new adversariesTrack how attackers are adapting to this technology.

Track this risk

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

11 events · Mar 11, 2026 – Jul 1, 2026

Jul 1, 20264mo ago
Drift Protocol rebrands to Velocity DEX ahead of relaunch
Drift Protocol announced it is rebranding to Velocity DEX as it rebuilds after the April 1 exploit. The planned relaunch includes a private beta, a leaner perpetuals-only USDT-settled platform, a new program with rotated keys, removal of the durable-nonce mechanism abused in the attack, and a recovery plan backed by protocol revenue, a $127.5 million Tether commitment, and up to $20 million from partners.
Drift Protocol Rebrands to Velocity DEX Ahead of Relaunch - "The Defiant"
Apr 5, 20267mo ago
Attorney argues Drift incident may constitute civil negligence
Attorney Ariel Givner said Drift Protocol could face civil negligence claims because the team allegedly failed to follow basic operational security practices, including isolating signing keys and properly vetting external contacts. The commentary framed the exploit as a warning about social engineering risks in crypto development.
Apr 5, 20267mo ago
Investigators attribute Drift attack to UNC4736/North Korea-linked actors
In post-mortem and follow-on reporting, investigators attributed the campaign with medium-high confidence to UNC4736, also known as AppleJeus or Citrine Sleet, and said it was likely linked to North Korean threat actors. Drift also said the same actors were behind the October 2024 Radiant Capital hack.
Apr 2, 20267mo ago
Drift says exploit required months of deliberate preparation
In later public findings, Drift said the exploit was the result of months of deliberate preparation by the attackers. The update reinforced that the theft stemmed from a prolonged social-engineering and malware campaign rather than a single isolated technical flaw.
Apr 2, 20267mo ago
Drift publishes preliminary findings on nonce-based exploit
By April 2, Drift had publicly described the incident as a highly sophisticated exploit involving abuse of Solana's durable nonce feature and pre-signed transactions rather than a simple smart contract bug. The disclosure also intensified scrutiny of Circle over its failure to freeze moved USDC during the response window.
Apr 1, 20267mo ago
Stolen assets swapped, bridged to Ethereum, and laundered
On-chain investigators said the attacker converted much of the stolen crypto into USDC and SOL, then bridged funds from Solana to Ethereum using Circle's Cross-Chain Transfer Protocol. The proceeds were subsequently moved through additional wallets and centralized exchanges.
Apr 1, 20267mo ago
Drift suspends protocol functions and starts incident response
After detecting the exploit, Drift suspended deposits and withdrawals or otherwise froze protocol functions, removed the compromised wallet from its multisig, and began coordinating with security firms, exchanges, bridges, and law enforcement. The DRIFT token reportedly fell more than 20% following the incident.
Apr 1, 20267mo ago
Drift Protocol exploited for about $280M-$285M
On April 1, 2026, attackers used Solana's durable nonce mechanism and pre-signed transactions to gain unauthorized Security Council administrative control and drain Drift vaults in about 12 minutes. Reports put the losses at approximately $280 million to $285 million.
Apr 1, 20267mo ago
Attackers stage on-chain setup using fake CarbonVote Token
Before the theft, the attackers created a fake asset called CarbonVote Token (CVT) and wash traded it to fabricate a price history. Investigators said Drift's oracle system then accepted the manipulated asset as legitimate collateral.
Mar 11, 20268mo ago
Attackers deliver malicious links and malware to Drift staff
Over roughly the next six months, the attackers allegedly sent malicious links and malware that compromised developer machines. Drift later said this developer compromise enabled the later administrative takeover.
Date unknown
Attackers begin social-engineering Drift developers at crypto conference
Drift said the operation began when attackers engaged team members at a major crypto conference in October 2025. The adversaries then spent months building trust with developers as part of a long-term infiltration campaign.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Threat actors

1 linked

Lazarus

Organizations

1 linked

Drift Protocol

Breaches

1 linked

DRIFTPROTOCOL-2026-04

Do you run this?Follow how adversaries are adapting to this technology, and where it touches your stack today.

Track This Risk

Source coverage

Sources

5 references tracked. Mallory keeps watching after this page renders.

ThedefiantNews · Jul 1, 2026

Drift Protocol Rebrands to Velocity DEX Ahead of Relaunch - "The Defiant"Open source ↗

CointelegraphNews · May 1, 2026

Drift Protocol Exploit Took 'Months Of Deliberate Preparation'Open source ↗

Thecyberexpress Com VulnerabilitiesNews · Apr 6, 2026

North Korea Spent 6 Months To Drain $285M From Drift Protocol In 12 MinsOpen source ↗

CointelegraphNews · Apr 5, 2026

Attorney Says Drift Protocol May Be Liable for Damages After AttackOpen source ↗

CointelegraphNews · Apr 2, 2026

Drift Says Nonce Attack Drove Exploit as Circle Faces USDC ScrutinyOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

cryptocurrency-platform-riskidentity-impersonation-frauddata-exfiltration-methodinitial-access-method

Drift Protocol exploit drained $280M after months-long social engineering campaign

Emerging Technology Risk · 5 sources · Updated 4mo ago · First seen May 25, 2026

New surface, new adversariesTrack how attackers are adapting to this technology.

Track this risk

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

11 events · Mar 11, 2026 – Jul 1, 2026

Jul 1, 20264mo ago
Drift Protocol rebrands to Velocity DEX ahead of relaunch
Drift Protocol announced it is rebranding to Velocity DEX as it rebuilds after the April 1 exploit. The planned relaunch includes a private beta, a leaner perpetuals-only USDT-settled platform, a new program with rotated keys, removal of the durable-nonce mechanism abused in the attack, and a recovery plan backed by protocol revenue, a $127.5 million Tether commitment, and up to $20 million from partners.
Drift Protocol Rebrands to Velocity DEX Ahead of Relaunch - "The Defiant"
Apr 5, 20267mo ago
Attorney argues Drift incident may constitute civil negligence
Attorney Ariel Givner said Drift Protocol could face civil negligence claims because the team allegedly failed to follow basic operational security practices, including isolating signing keys and properly vetting external contacts. The commentary framed the exploit as a warning about social engineering risks in crypto development.
Apr 5, 20267mo ago
Investigators attribute Drift attack to UNC4736/North Korea-linked actors
In post-mortem and follow-on reporting, investigators attributed the campaign with medium-high confidence to UNC4736, also known as AppleJeus or Citrine Sleet, and said it was likely linked to North Korean threat actors. Drift also said the same actors were behind the October 2024 Radiant Capital hack.
Apr 2, 20267mo ago
Drift says exploit required months of deliberate preparation
In later public findings, Drift said the exploit was the result of months of deliberate preparation by the attackers. The update reinforced that the theft stemmed from a prolonged social-engineering and malware campaign rather than a single isolated technical flaw.
Apr 2, 20267mo ago
Drift publishes preliminary findings on nonce-based exploit
By April 2, Drift had publicly described the incident as a highly sophisticated exploit involving abuse of Solana's durable nonce feature and pre-signed transactions rather than a simple smart contract bug. The disclosure also intensified scrutiny of Circle over its failure to freeze moved USDC during the response window.
Apr 1, 20267mo ago
Stolen assets swapped, bridged to Ethereum, and laundered
On-chain investigators said the attacker converted much of the stolen crypto into USDC and SOL, then bridged funds from Solana to Ethereum using Circle's Cross-Chain Transfer Protocol. The proceeds were subsequently moved through additional wallets and centralized exchanges.
Apr 1, 20267mo ago
Drift suspends protocol functions and starts incident response
After detecting the exploit, Drift suspended deposits and withdrawals or otherwise froze protocol functions, removed the compromised wallet from its multisig, and began coordinating with security firms, exchanges, bridges, and law enforcement. The DRIFT token reportedly fell more than 20% following the incident.
Apr 1, 20267mo ago
Drift Protocol exploited for about $280M-$285M
On April 1, 2026, attackers used Solana's durable nonce mechanism and pre-signed transactions to gain unauthorized Security Council administrative control and drain Drift vaults in about 12 minutes. Reports put the losses at approximately $280 million to $285 million.
Apr 1, 20267mo ago
Attackers stage on-chain setup using fake CarbonVote Token
Before the theft, the attackers created a fake asset called CarbonVote Token (CVT) and wash traded it to fabricate a price history. Investigators said Drift's oracle system then accepted the manipulated asset as legitimate collateral.
Mar 11, 20268mo ago
Attackers deliver malicious links and malware to Drift staff
Over roughly the next six months, the attackers allegedly sent malicious links and malware that compromised developer machines. Drift later said this developer compromise enabled the later administrative takeover.
Date unknown
Attackers begin social-engineering Drift developers at crypto conference
Drift said the operation began when attackers engaged team members at a major crypto conference in October 2025. The adversaries then spent months building trust with developers as part of a long-term infiltration campaign.

Linked entities