Drift Protocol exploit drains $286M on Solana; DPRK-linked laundering suspected

A Solana-based DeFi perps venue, Drift Protocol, suffered a major Drift Protocol exploit on April 1, draining about $286 million across nearly 20 vaults within ~20 minutes. Drift paused deposits and withdrawals and said it was coordinating with security firms, bridges, and exchanges. Elliptic later released an investigation claiming the on-chain behavior and network indicators match prior DPRK-linked operations. The report suggests the attacker likely compromised administrator private keys, enabling takeover of security governance controls and withdrawals. Elliptic’s findings point to a staged operation: the attacker created/used a wallet about eight days before the exploit and received a small test transfer from a Drift vault. The Drift Protocol exploit targeted three main vaults—JLP Delta Neutral, SOL Super Staking, and BTC Super Staking—plus a reported single JLP transfer worth $41.7 million (cited as ~155 million in value terms in the article). After the incident, the funds were allegedly swapped via Jupiter (Solana DEX aggregator) into USDC, bridged to Ethereum, and then rotated across multiple wallets using ETH and other assets. Trading/market impact signals in the article include Drift’s TVL falling from ~$550 million to under ~$250 million. The piece also references alleged links to prior large hacks attributed to North Korean actors (e.g., methods compared to Bybit’s $1.4B breach). For traders, the key takeaway is that this Drift Protocol exploit could raise short-term risk aversion toward Solana DeFi governance and admin-key/multisig designs, while also increasing monitoring of stolen-asset flows on SOL, USDC, and across Ethereum.