North Korea Manufactured a Fake Token to Steal $286M From Drift Protocol and AI Is Making These Attacks Cheaper

The largest DeFi hack this year took place last week on April 1 as Drift Protocol, one of the largest perp DEXs on the solana network, experienced an exploit that saw roughly $286 million vanish from the protocol. The attack was tied to North Korean-linked hackers and the entire hack transpired in just 10 seconds. What’s astonishing about this hack however was the meticulous nature of it. No code was broken and no smart contract had a bug. Investigations from crypto forensics firms like Elliptic and TRM Labs actually point to a much more calculated hack. 

North Korean attackers spent three weeks manufacturing a fake token called CarbonVote, seeding it with a few thousand dollars to make it look real, while at the same time social-engineering two of Drift’s five multisig Security Council signers into pre-signing hidden authorizations they didn’t fully understand. Following this, they then used a Solana feature called “durable nonces” to hold those signatures in reserve for over a week, waiting for the right moment. All it took was a single transaction on April 1. 

As noted by Elliptic, this attack was the 18th crypto hack linked to North Korea just this year, pulling around $300 million out of the space. Four days after the hack, Ledger’s CTO went on record to highlight the alarming nature of the hack and that AI is driving the cost of attacks like this “down to zero”. That statement matters a lot because the Drift hack is a case study in how these operations now work. The attackers did not need a zero-day vulnerability or a top-notch cryptographer. All they needed was patience, a convincing fake token and two humans they could manipulate. The hack actually exposed structural vulnerability in DeFi as it is today. DeFi is building billion dollar infrastructure secured by small groups of people who can be tricked, while the adversaries are getting better at doing exactly that. 

How North Korea Stole $286 Million in 10 Seconds 

The Drift protocol hack was a sophisticated exploit that spanned across three weeks of preparation. Bloomberg first reported the breach on April 1, when Drift protocol confirmed that roughly $286 million in user assets had been siphoned out. The entire scheme actually started all the way back on March 11 when the attacker pulled 10 ETH from Tornado Cash at around 9 AM Pyongyang time and used it to deploy the fake token, CarbonVote (CVT), a completely fictitious asset seeded with a few thousand dollars in liquidity and kept alive through wash trading. 

Over the course of the next two weeks, between March 23 and March 30, the attacker opened durable nonce accounts, a legitimate feature on the Solana network that lets transactions be pre-signed and held indefinitely without expiring. During this window, the attacker social-engineered two of Drift’s five Security Council multisig signers into approving transactions that looked normal but, as TRM Labs later confirmed, carried hidden authorizations for critical admin control. 

The final piece fell on March 27, when Drift migrated its Security Council to a new 2/5 threshold configuration with zero timelock as reported by BlockSec, which basically removed the only delay that would have allowed anyone to catch what was coming. By the time April 1 came along, the trap had been fully loaded for days. 

On April 1, the attacker used those pre-signed approvals to list CarbonVote as valid collateral, inflated its value into the hundreds of millions via manipulated oracle pricing and governance was seized. From there, 31 withdrawal transactions emptied Drift’s vaults in a matter of seconds. The largest chunk alone included over $155 million worth of JLP tokens alongside tens of millions in USDC, SOL, ETH and other liquid staking tokens being drained and the Total Value Locked on the protocol collapsed instantly from around $550 million to under $250 million. 

This speed of the hack is only one part of this story. A detailed plan that went for as long as three weeks which ended in a 10 second hack showed how easily governance, not code, can become the weakest link in DeFi. 

North Korea’s $300 Million Crypto War in 2026 

This hack, reportedly perpetrated by North Korean-linked attackers, is by no means an isolated event. In fact, if you look into some of the most high profile hacks over the past few years, it becomes evident that this is part of a much larger, state driven campaign. This year alone, Elliptic has reported that the Drift exploit makes it the 18th DPRK-attributed crypto theft, pushing the total amount of funds being siphoned past $300 million thus far this year. If you look beyond this year, the scale of such hacks from a single country becomes very hard to ignore. Last year, North Korea-linked actors stole between $1.92 billion as per TRM Labs while Chainalysis puts this figure at $2.02 billion in crypto. This marked a 51% year over year jump in hacks conducted by this group and pushed their all time heist to $6.75 billion. 

North Korea accounted for a record 76% of all service compromises in 2025 meaning one country is responsible for the overwhelming majority of thefts taking place in the industry. Against that backdrop, the Drift hack, which is now the second largest exploit within the Solana ecosystem after the 2022 Wormhole breach, fits into a pattern of attacks. 

What defines that pattern is consistency. The Bybit hack in February 2025, the largest crypto theft in history, had nearly identical setups that included social engineering, compromised access and coordinated fund exchange. TRM Labs notes that DPRK operators increasingly rely on “Chinese laundromat” networks for funds being bridged across different chains within hours. 

The Drift attack actually shows a system of state-backed teams running multi-week operations with reconnaissance, human manipulation, and global laundering infrastructure already in place. 

AI Is Driving Attack Costs “Down to Zero”: Ledger’s CTO Warns

Four days after the Drift drain, Ledger CTO Charles Guillemet told CoinDesk something that reframed the entire incident. “Finding vulnerabilities and exploiting them becomes really, really easy,” he said. “The cost is going down to zero.” Guillemet didn’t name Drift, but he described its exact mechanics. AI doesn’t just help attackers find code bugs faster, it makes social engineering more convincing, phishing more personalized, and the preparation work that North Korean operators spent three weeks doing on Drift cheaper and more scalable by an order of magnitude. He also pointed to a compounding problem on the defensive side: as more developers rely on AI-generated code, vulnerabilities could spread faster than human reviewers can catch them. “There is no ‘make it secure’ button,” he said. “We are going to produce a lot of code that will be insecure by design.” Hacks and exploits caused $1.4 billion in crypto losses over the past year, and Guillemet’s projection is that the curve gets steeper, not flatter. 

The Drift hack is the clearest proof of concept for that warning. The attackers never touched the code, they targeted the two humans holding the keys. AI doesn’t need to break a smart contract if it can generate a convincing enough pretext to trick a multisig signer into approving a transaction they don’t fully understand. Guillemet expects the industry to split: critical systems like wallets and core protocols will invest heavily in security and adapt, but much of the broader software ecosystem may struggle to keep pace. His recommended fixes,  formal verification using mathematical proofs, hardware isolation for private keys, are structurally sound but require a level of institutional discipline that most DeFi protocols, including Drift, haven’t yet built in. “When you have a dedicated device not exposed to the internet, it is more secure by design,” he said. The Drift Security Council had no such buffer. Two signatures, zero timelock, and a fake token was all it took.

What Happens Next: Drift’s Recovery and Industry Response

What happens next for Drift Protocol is far from clear and the early signals are already dividing the industry. In the immediate aftermath, Anatoly Yakovenko suggested a potential recovery path: issuing an IOU-style token airdrop to affected users, mirroring Bitfinex’s 2016 playbook after its $72 million hack. 

The idea is simple — socialize losses now, repay users over time if the protocol recovers. But the context is very different. Drift’s TVL has been cut nearly in half, deposits and withdrawals remain suspended, and unlike Bitfinex, it lacks a centralized revenue engine to backstop those liabilities. That has led to immediate pushback: IOU tokens, in this case, risk becoming purely speculative instruments with no clear path to redemption.

At the same time, on-chain activity is raising new concerns. Onchain Lens flagged that a wallet linked to the Drift team moved 56.25 million DRIFT tokens (≈$2.44 million) to centralized exchanges including Bybit and Gate shortly after the exploit, a move that typically precedes selling pressure and has fueled speculation about insider positioning during a liquidity crisis. 

Meanwhile, the attacker’s funds have already been bridged across chains, most notably to Ethereum, reducing the probability of meaningful recovery with each passing day. The broader implication is that this incident won’t end with Drift. It is likely to accelerate industry-wide scrutiny around DeFi governance itself, from multisig security standards and timelock requirements to oracle design and execution controls. What comes next hinges on three variables: whether Drift can present a credible recovery plan, whether any portion of funds can be traced or frozen, and whether this finally forces structural reform, or becomes just another expensive lesson the industry moves past.

If you're reading this, you’re already ahead. Stay there with our newsletter.