Drift Protocol Hack Involved $270 Million Loss in Suspected Six-Month North Korean Operation

The Drift Protocol, a decentralized finance platform built on the Solana blockchain, experienced a major security breach on February 17, 2024, resulting in the loss of approximately $270 million in user funds. According to a CoinDesk analysis, the incident stemmed from a sophisticated operation that lasted six months and involved actors suspected to be affiliated with North Korean intelligence.

The exploit targeted the protocol's oracle system, allowing attackers to manipulate price feeds and drain liquidity pools.

Investigators detailed how the perpetrators posed as representatives of a quantitative trading firm to gain trust within the DeFi community. They attended cryptocurrency conferences in multiple countries, including the United States and Europe, where they met in person with Drift Protocol contributors and developers.

This social engineering approach enabled them to gather insider information about the platform's architecture and security measures.

Prior to the hack, the attackers deposited $1 million of their own capital into the Drift Protocol, which helped them establish credibility and avoid immediate suspicion. CoinDesk reported that this deposit was part of a broader strategy to integrate into the ecosystem before executing the drain. The funds were reportedly funneled through various mixers and exchanges to obscure their origins.

The breach directly impacted users who had provided liquidity to Drift's perpetual futures markets, with losses primarily in USDC stablecoins and other cryptocurrencies. Solana's ecosystem, already under scrutiny for past incidents, faced renewed questions about the security of its DeFi applications.

Drift Protocol paused operations immediately after detecting the anomaly and began efforts to recover affected assets, though the full extent of reimbursements remains unclear.