Drift Protocol Hack: How a North Korean Group Spent Six Months Infiltrating a DeFi Protocol

Drift Protocol suspended all operations after a sophisticated six-month infiltration by a North Korean state-backed group culminating in an exploit on April 1, 2026. The attackers posed as a legitimate trading firm, conducted in-person meetings across multiple countries, and used three attack vectors including a silent code execution flaw in development tools.

• →A North Korean state-backed group spent six months infiltrating Drift Protocol by posing as a trading firm.
• →Attackers conducted sophisticated social engineering including in-person meetings across multiple countries.
• →Three attack vectors were identified, including a silent code execution vulnerability in VSCode and Cursor editors.
• →Drift Protocol froze all protocol functions immediately after discovering the targeted exploit.
• →SEAL911 has attributed the attack to the state-backed group, highlighting advanced persistent threat tactics in DeFi.