{"id":499,"date":"2026-04-05T19:19:03","date_gmt":"2026-04-05T19:19:03","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=499"},"modified":"2026-04-05T19:19:03","modified_gmt":"2026-04-05T19:19:03","slug":"285-million-drift-hack-traced-to-six-month-dprk-social-engineering-operation","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=499","title":{"rendered":"$285 Million Drift Hack Traced to Six-Month DPRK Social Engineering Operation"},"content":{"rendered":"
\n
<\/a><\/div>\n

Drift\u00a0has revealed<\/a> that the April 1, 2026, attack that led to\u00a0the theft of $285\u00a0million was the culmination of a months-long targeted and meticulously planned social engineering operation undertaken by the Democratic People’s Republic of Korea (DPRK) that began in the fall of\u00a02025.<\/p>\n

The\u00a0Solana-based decentralized exchange described it as \u00aban attack six months in the making,\u00bb attributing it with medium confidence to a North Korean state-sponsored hacking group\u00a0dubbed UNC4736<\/strong>, which is also tracked under the cyptonyms AppleJeus, Citrine Sleet, Golden Chollima, and Gleaming\u00a0Pisces.<\/p>\n

The\u00a0threat actor has\u00a0a history of targeting the cryptocurrency sector for financial theft since at least 2018. It’s best known for\u00a0the X_TRADER\/3CX supply chain\u00a0breach in 2023 and\u00a0the $53 million\u00a0hack of decentralized finance (DeFi)\u00a0platform Radiant\u00a0Capital<\/a> in October\u00a02024.<\/p>\n

\u00abThe basis for this connection is both on-chain (fund flows used to stage and test this operation trace back to the Radiant attackers) and operational (personas deployed across this campaign have identifiable overlaps with known DPRK-linked activity),\u00bb Drift said in a Sunday\u00a0analysis.<\/p>\n

In\u00a0an assessment published in late January 2026, cybersecurity company CrowdStrike described Golden Chollima as an offshoot of Labyrinth Chollima that’s primarily geared towards cryptocurrency theft by targeting small fintech firms in the U.S., Canada, South Korea, India, and Western\u00a0Europe.<\/p>\n

\u00abThe adversary typically conducts smaller-value thefts at a more consistent operational tempo, suggesting responsibility for ensuring baseline revenue generation for the DPRK regime,\u00bb CrowdStrike said. \u00abDespite improving trade relations with Russia, the DPRK requires additional revenue to fund ambitious military plans that include constructing new destroyers, building nuclear-powered submarines, and launching additional reconnaissance satellites.\u00bb<\/p>\n

In\u00a0at least one incident observed in late 2024, UNC4736 delivered malicious Python packages through a fraudulent recruitment scheme to a European fintech company. Upon\u00a0gaining access, the threat actor moved laterally to the victim’s cloud environment to access IAM configurations and associated cloud resources, and ultimately diverted cryptocurrency assets to adversary-controlled\u00a0wallets.<\/p>\n

How the Drift Attack Likely\u00a0Unfolded<\/h3>\n

Drift, which is working with law enforcement and forensic partners to piece together the sequence of events that led to the hack, said it was the target of a \u00abstructured intelligence operation\u00bb that required months of\u00a0planning.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Starting in or about fall 2025, individuals posing as a quantitative trading company approached Drift contributors at a major cryptocurrency conference and international crypto conferences under the pretext of integrating the protocol. It\u00a0has since emerged that this was a deliberate approach, where members of this trading group approached and built rapport with specific Drift contributors at various major industry conferences that took place in several countries over a period of six\u00a0months.<\/p>\n

\u00abThe individuals who appeared in person were not North Korean nationals,\u00bb Drift explained. \u00abDPRK threat actors operating at this level are known to deploy third-party intermediaries to conduct face-to-face relationship-building.\u00bb<\/p>\n

\u00abThey were technically fluent, had verifiable professional backgrounds, and were familiar with how Drift operated. A\u00a0Telegram group was established upon the first meeting, and what followed were months of substantive conversations around trading strategies and potential vault integrations. These\u00a0interactions are typical of how trading firms interact and onboard with\u00a0Drift.\u00bb<\/p>\n

Then, sometime between December 2025 and January 2026, the group onboarded an Ecosystem Vault on Drift, a step that required filling out a form with strategy details. As\u00a0part of this process, the individuals are said to have engaged with multiple contributors, asking them \u00abdetailed and informed product questions,\u00bb while depositing more than $1 million of their own\u00a0funds.<\/p>\n

This, Drift said, was a calculated move designed to build a functioning operational presence inside the Drift ecosystem, with integration conversations continuing with the contributors through February and March 2026. This\u00a0included sharing links for projects, tools, and applications that the company claimed to be developing.<\/p>\n

The\u00a0possibility that these interactions with the trading group may have acted as the initial infection pathway assumed significance in the wake of the April 1 hack. But\u00a0as Drift revealed, their Telegram chats and malicious software had been deleted right around the time the attack took\u00a0place.<\/p>\n

It’s suspected that there may be two primary attack vectors\u00a0–<\/p>\n