Drift Protocol hack: fake quant firm trap led to $285M loss
The Drift Protocol hack unfolded over six months, with attackers posing as a quantitative trading firm rather than stealing keys in a single moment. Starting in fall 2025, the group built trust through in-person meetings across multiple countries and onboarding-heavy discussions.
A Telegram channel was created on day one. By December 2025, attackers had onboarded an Ecosystem Vault and deposited over $1 million of their own capital. By February 2026, contributors believed the relationship was legitimate.
On April 1, 2026, Drift says the attacker’s access was converted into active exploitation. Telegram chats disappeared, malicious software was removed from affected endpoints, and the incident led to $285 million taken—after Drift had already been compromised.
Drift lists three likely entry vectors: (1) a cloned repository for a “vault frontend,” (2) persuading a contributor to install a TestFlight app marketed as a wallet product, and (3) exploiting a known VSCode/Cursor vulnerability (Dec 2025–Feb 2026) that can silently execute arbitrary code when opening files/folders.
Attribution is linked, with medium-high confidence, to DPRK state-affiliated actors tracked as UNC4736/AppleJeus/Citrine Sleet, tied to the earlier October 2024 Radiant Capital attack. Mandiant formal attribution and device forensics are still in progress.
Response: Drift froze remaining protocol functions, removed compromised wallets from multisig, and flagged attacker wallets with exchanges/bridge operators. Drift urges potentially targeted teams to contact SEAL911. For traders, this Drift Protocol hack reinforces smart-contract and “trust-layer” security risk across DeFi vaults and can pressure sentiment around DRIFT in the near term.
Bearish
This news is bearish for DRIFT because the Drift Protocol hack involved long-duration trust-layer compromise that resulted in a large $285M loss. In the short term, traders typically react by de-risking DeFi vault exposure, widening perceived smart-contract and operational risk premiums, and selling the affected protocol’s token. In the long term, even with mitigations (freezing functions, removing multisig members, exchange/bridge flagging), the uncertainty around the exact compromise moment and the detailed social-engineering workflow can sustain lower confidence in ecosystem vault onboarding processes. Compared with a purely technical exploit, this “months-long infiltration” pattern tends to keep risk aversion elevated across similar projects.