Morning Minute: North Korea Hacks Drift for $285M

2 weeks ago 9

Tyler Warner

Mon, April 6, 2026 astatine 7:18 AM CDT 8 min read

Morning Minute is simply a regular newsletter written by Tyler Warner. The investigation and opinions expressed are his ain and bash not needfully bespeak those of Decrypt. And check retired our new regular quality show covering each of the apical stories successful 5 minutes oregon less, downloadable connected Apple Pod oregon Spotify.

GM!

Today’s apical news:

Crypto majors leap connected speculation of ceasefire; BTC +4% astatine $69,500
Drift requests talks with NK hackers aft $280M exploit
Schwab is bringing crypto spot trading to its $12T platform
Coinbase received conditional support for nationalist spot slope charter
Circle is launching cirBTC to vie with WBTC

Drift Protocol, Solana’s largest decentralized perp exchange, was exploited for $285 cardinal connected April 1.

As much accusation came retired astir the exploit, it seems to person been a governance attack, months successful the making, that culminated successful 12 minutes of automated draining crossed 31 accelerated withdrawals.

The setup started successful October 2025 erstwhile attackers posing arsenic a quantitative trading steadfast approached Drift contributors astatine “a large crypto conference.” Over six months they built existent relationships with protocol insiders successful person, astatine aggregate manufacture events. When the clip came, they utilized that entree to socially technologist multisig signers into pre-approving hidden transactions - done a Solana diagnostic called durable nonces that allowed the authorizations to beryllium dormant for weeks. They besides manufactured a fake token (CarbonVote/CVT) with a fewer 1000 dollars successful seeded liquidity and lavation trading, past utilized it to manipulate Drift’s terms oracles into treating it arsenic morganatic collateral worthy hundreds of millions.

Elliptic and TRM Labs some flagged DPRK involvement, making this allegedly the 18th North Korean crypto onslaught of 2026, with implicit $300M stolen truthful acold this twelvemonth alone.

Key Details:

Drift was exploited for $285M connected April 1 successful the largest DeFi hack of 2026 and the second-largest successful Solana past down the $326M Wormhole hack successful 2022
The attack: atrocious actors manufactured a fake token (CVT), manipulated oracles to dainty it arsenic existent collateral, and utilized pre-signed durable nonce transactions to drain vaults crossed 31 withdrawals successful 12 minutes
Six-month operation: attackers posed arsenic a quant steadfast astatine crypto events starting October 2025, cultivating spot with Drift contributors successful idiosyncratic earlier accessing admin keys via societal engineering
DRIFT token fell implicit 40%; TVL collapsed from ~$550M to nether $250M; a twelve Solana protocols with Drift dependencies paused operations
Circle controversy: $232M successful USDC bridged to Ethereum via Circle’s CCTP; ZachXBT said Circle could person moved faster to frost funds; Circle says it lone freezes assets erstwhile legally required