What happened in the Drift Protocol hack?

Drift Protocol, a Solana-based decentralised exchange, was exploited for about $285 million, making it the largest crypto hack this year. The attack led to a sharp decline in its token price, which dropped over 40%. The scale and execution of the exploit have raised concerns across the DeFi sector.

Why does Elliptic believe North Korea is behind the Drift hack?

Elliptic identified multiple indicators consistent with past North Korean (DPRK) operations, including structured laundering and staged onchain behaviour. These patterns match previous state-linked attacks. However, attribution is not fully confirmed and remains an assessment.

How were the stolen funds from Drift Protocol laundered?

The funds were quickly consolidated, swapped into more liquid assets, and moved across multiple blockchains. This cross-chain laundering makes tracking more difficult. The process appears highly organised and repeatable.

What happened to the Drift Protocol token after the hack?

The Drift token fell more than 40% to around $0.06 following the exploit. This reflects reduced investor confidence and uncertainty about the platform’s recovery. Price reactions like this are common after major security breaches.

What makes this hack different from other crypto exploits?

Elliptic described the attack as premeditated, with early test transactions and pre-positioned wallets. This suggests a high level of planning rather than an opportunistic exploit. The structured execution is typical of advanced threat actors.

Why is Solana harder to track in cases like this?

Solana uses a fragmented account model where each asset sits in separate token accounts. This can make a single attacker’s activity appear spread across many addresses. Without advanced tools, investigators may miss the full picture.

What is “cross-chain laundering” and why does it matter?

Cross-chain laundering involves moving stolen funds between different blockchains like Solana and Ethereum. This helps attackers obscure the origin of funds. It is becoming a common tactic in large-scale crypto theft.

How much crypto has North Korean-linked groups stolen recently?

Elliptic estimates DPRK-linked actors have already stolen over $300 million this year across multiple incidents. Other reports suggest billions have been stolen in recent years. These funds are often linked by authorities to state activities.

Cryptocurrency

Image for illustrative purposes only. Not a real photo.

Elliptic links Drift hack to North Korea

Written by Isaac FrancisPublished Apr 3, 2026, 12:00 AM

Blockchain analytics firm Elliptic said the $285 million exploit of Drift Protocol shows multiple indicators of involvement by North Korean state-linked hackers.

The attack, the largest crypto exploit this year, triggered a sharp drop in Drift’s token, which has fallen more than 40% to around $0.06 since the incident.

“If confirmed, this incident would represent the eighteenth DPRK act Elliptic has tracked this year, with over $300 million stolen so far,”

The firm said.

Elliptic identified patterns of premeditated onchain behaviour, including test transactions and pre-positioned wallets, followed by rapid consolidation and laundering of funds.

The stolen assets were quickly moved across chains, swapped into more liquid tokens, and distributed through multiple addresses in a structured effort to obscure their origin.

The report highlights Solana’s fragmented account model as a key challenge, as activity tied to a single actor can appear split across multiple token accounts without advanced clustering tools.

Elliptic said entity-level clustering and cross-chain tracing are essential to track such activity, especially as laundering increasingly spans networks like Ethereum.

The incident adds to a broader trend, with DPRK-linked actors reportedly responsible for billions in crypto theft, often linked by US authorities to funding weapons programmes.

At the time of reporting, Solana price was $79.35.