Drift Protocol Loses $286 Million in Suspected DPRK-Linked Crypto Attack

Drift Protocol suffered a $286 million exploit that Elliptic described as suspected DPRK-linked. MetaMask’s April security report placed the incident within a wave of thefts totaling more than $500 million across Drift, KelpDAO and CoW Swap, with North Korean operatives suspected in at least two incidents. The report also highlighted a fake Ledger application on Apple’s App Store that drained $9.5 million from 50 victims and an insider who infiltrated Kraken’s support systems. The incidents underscore exposure across decentralized protocols, wallet distribution and exchange support operations.

Developer infrastructure was also targeted through compromised Axios npm releases, versions 1.14.1 and 0.30.4. Attackers added plain-crypto-js 4.2.1, whose postinstall script delivered a remote-access Trojan targeting macOS, Windows and Linux. Socket reportedly detected the malicious dependency six minutes after publication, approximately 30 minutes before attackers added it to Axios. Organizations should check dependency inventories and installation logs for the affected versions, investigate potentially exposed developer endpoints, and review credentials accessible from those systems. Wallet users should independently verify application publishers and download sources rather than relying solely on app-store availability.