{"id":8067,"date":"2026-04-03T06:02:17","date_gmt":"2026-04-03T06:02:17","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=8067"},"modified":"2026-04-03T06:02:17","modified_gmt":"2026-04-03T06:02:17","slug":"280m-drift-hack-linked-to-suspected-north-korean-attack-using-novel-solana-exploit","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=8067","title":{"rendered":"$280M Drift Hack Linked to Suspected North Korean Attack Using Novel Solana Exploit"},"content":{"rendered":"

<\/p>\n

\n
\n
\n
    \n
  • Attackers drained approximately US$280 million from Drift Protocol on April 1, exploiting Solana\u2019s durable nonce feature to pre-sign malicious transactions weeks in advance and seize security council control.<\/span><\/li>\n
  • Three protocol vaults were emptied, including approximately 41.7 million JLP tokens worth roughly US$155 million, before stolen funds were rapidly swapped to USDC and bridged to Ethereum.<\/span><\/li>\n
  • Blockchain analytics firm Elliptic identified multiple on-chain indicators consistent with North Korean state tradecraft.<\/span><\/li>\n<\/ul>\n<\/div>\n<\/div>\n

    Drift Protocol, Solana\u2019s largest decentralised perpetual futures exchange, lost approximately US$280 million (AU$400 million) on April 1 after attackers exploited a novel Solana feature to pre-approve malicious admin transactions weeks in advance, seizing security council control and draining three protocol vaults.<\/p>\n

    Blockchain analytics firm Elliptic flagged the operation as a suspected North Korean state attack.<\/p>\n

    Drift Protocol held approximately US$550 million (AU$843 million) in total value locked (TVL) before the attack. That figure collapsed to under US$250 million (AU$383 million) within hours of the exploit.\u00a0<\/p>\n

    As collateral, SOL\u2019s spot price dropped roughly 9% to approximately US$78.60 (AU$120.40), marking the second-largest Solana exploit on record after the Wormhole bridge attack of 2022, which drained US$326 million (AU$499 million).<\/p>\n

    Read more: Bitrefill Hack Exposes Wallets and Gift Card Systems as North Korean Links Emerge<\/strong><\/p>\n

    Not An April Fools\u2019 Joke<\/h2>\n

    Crypto News Australia reported how Drift acknowledged the breach in real time.<\/p>\n

    \n
    \n

    We are observing unusual activity on the protocol. We are currently investigating. Please do not deposit funds into the protocol while we investigate. This is not an April Fools joke.<\/em><\/p>\n<\/div>\n

    \n Drift Protocol <\/div>\n<\/div>\n

    Blockchain analytics firm Elliptic attributed the attack to North Korean-linked actors, citing transaction patterns, laundering methods, and network signatures consistent with prior operations.\u00a0<\/p>\n

    The firm estimated total losses at US$286 million (AU$415 million) and said the incident was the 18th suspected DPRK-linked crypto attack in 2026. Year-to-date, such groups have stolen more than US$300 million (AU$435 million).<\/p>\n

    North Korean-linked actors stole about US$2 billion (AU$2.9 billion) in crypto in 2025, representing roughly 60% of global theft that year. Across all recorded operations, cumulative losses exceed US$6.5 billion (AU$9.43 billion), funds the U.S. government has linked to weapons development programs.<\/p>\n

    The Drift exploit is one of the largest decentralised finance breaches to date, following the US$1.5 billion (AU$2.18 billion) Bybit hack in 2025.<\/p>\n

    Related: Man Charged in Crypto Exchange Hacks Faces Up to 30 Years<\/strong><\/p>\n<\/p><\/div>\n

    Hackers,North Korea,Solana#280M #Drift #Hack #Linked #Suspected #North #Korean #Attack #Solana #Exploit1775196137<\/p>\n","protected":false},"excerpt":{"rendered":"

    Attackers drained approximately US$280 million from Drift Protocol on April 1, exploiting Solana\u2019s durable nonce feature to pre-sign malicious transactions weeks in advance and seize security council control. Three protocol vaults were emptied, including approximately 41.7 million JLP tokens worth roughly US$155 million, before stolen funds were rapidly swapped to USDC and bridged to Ethereum.<\/p>\n","protected":false},"author":1,"featured_media":8068,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[3754,1280,2314,664,652,1137,3070,3401,152,3755],"class_list":{"0":"post-8067","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-bitcoin","8":"tag-280m","9":"tag-attack","10":"tag-drift","11":"tag-exploit","12":"tag-hack","13":"tag-korean","14":"tag-linked","15":"tag-north","16":"tag-solana","17":"tag-suspected"},"yoast_head":"\n$280M Drift Hack Linked to Suspected North Korean Attack Using Novel Solana Exploit - Crypto News: Latest Cryptocurrency News and Analysis<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptonews.uk.com\/?p=8067\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"$280M Drift Hack Linked to Suspected North Korean Attack Using Novel Solana Exploit\" \/>\n<meta property=\"og:description\" content=\"Attackers drained approximately US$280 million from Drift Protocol on April 1, exploiting Solana\u2019s durable nonce feature to pre-sign malicious transactions weeks in advance and seize security council control. Three protocol vaults were emptied, including approximately 41.7 million JLP tokens worth roughly US$155 million, before stolen funds were rapidly swapped to USDC and bridged to Ethereum.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptonews.uk.com\/?p=8067\" \/>\n<meta property=\"og:site_name\" content=\"Crypto News: Latest Cryptocurrency News and Analysis\" \/>\n<meta property=\"article:published_time\" content=\"2026-04-03T06:02:17+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cdn.cryptonews.com.au\/2026\/04\/03155458\/Drift-Protocol.jpg\" \/>\n<meta name=\"author\" content=\"\u884c\u653f\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u884c\u653f\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=8067\",\"url\":\"https:\/\/cryptonews.uk.com\/?p=8067\",\"name\":\"$280M Drift Hack Linked to Suspected North Korean Attack Using Novel Solana Exploit - Crypto News: Latest Cryptocurrency News and Analysis\",\"isPartOf\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=8067#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=8067#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/04\/108384.webp.webp\",\"datePublished\":\"2026-04-03T06:02:17+00:00\",\"author\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\"},\"breadcrumb\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=8067#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptonews.uk.com\/?p=8067\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=8067#primaryimage\",\"url\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/04\/108384.webp.webp\",\"contentUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/04\/108384.webp.webp\",\"width\":1280,\"height\":720},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=8067#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptonews.uk.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"$280M Drift Hack Linked to Suspected North Korean Attack Using Novel Solana Exploit\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptonews.uk.com\/#website\",\"url\":\"https:\/\/cryptonews.uk.com\/\",\"name\":\"Crypto News: Latest Cryptocurrency News and Analysis\",\"description\":\"Latest Crypto & Bitcoin News\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cryptonews.uk.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\",\"name\":\"\u884c\u653f\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"caption\":\"\u884c\u653f\"},\"sameAs\":[\"http:\/\/demo3.aiwalls.com\/coinbase\"],\"url\":\"https:\/\/cryptonews.uk.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"$280M Drift Hack Linked to Suspected North Korean Attack Using Novel Solana Exploit - Crypto News: Latest Cryptocurrency News and Analysis","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptonews.uk.com\/?p=8067","og_locale":"en_US","og_type":"article","og_title":"$280M Drift Hack Linked to Suspected North Korean Attack Using Novel Solana Exploit","og_description":"Attackers drained approximately US$280 million from Drift Protocol on April 1, exploiting Solana\u2019s durable nonce feature to pre-sign malicious transactions weeks in advance and seize security council control. Three protocol vaults were emptied, including approximately 41.7 million JLP tokens worth roughly US$155 million, before stolen funds were rapidly swapped to USDC and bridged to Ethereum.","og_url":"https:\/\/cryptonews.uk.com\/?p=8067","og_site_name":"Crypto News: Latest Cryptocurrency News and Analysis","article_published_time":"2026-04-03T06:02:17+00:00","og_image":[{"url":"https:\/\/cdn.cryptonews.com.au\/2026\/04\/03155458\/Drift-Protocol.jpg","type":"","width":"","height":""}],"author":"\u884c\u653f","twitter_card":"summary_large_image","twitter_misc":{"Written by":"\u884c\u653f","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/cryptonews.uk.com\/?p=8067","url":"https:\/\/cryptonews.uk.com\/?p=8067","name":"$280M Drift Hack Linked to Suspected North Korean Attack Using Novel Solana Exploit - Crypto News: Latest Cryptocurrency News and Analysis","isPartOf":{"@id":"https:\/\/cryptonews.uk.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptonews.uk.com\/?p=8067#primaryimage"},"image":{"@id":"https:\/\/cryptonews.uk.com\/?p=8067#primaryimage"},"thumbnailUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/04\/108384.webp.webp","datePublished":"2026-04-03T06:02:17+00:00","author":{"@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf"},"breadcrumb":{"@id":"https:\/\/cryptonews.uk.com\/?p=8067#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptonews.uk.com\/?p=8067"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/?p=8067#primaryimage","url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/04\/108384.webp.webp","contentUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/04\/108384.webp.webp","width":1280,"height":720},{"@type":"BreadcrumbList","@id":"https:\/\/cryptonews.uk.com\/?p=8067#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptonews.uk.com\/"},{"@type":"ListItem","position":2,"name":"$280M Drift Hack Linked to Suspected North Korean Attack Using Novel Solana Exploit"}]},{"@type":"WebSite","@id":"https:\/\/cryptonews.uk.com\/#website","url":"https:\/\/cryptonews.uk.com\/","name":"Crypto News: Latest Cryptocurrency News and Analysis","description":"Latest Crypto & Bitcoin News","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptonews.uk.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf","name":"\u884c\u653f","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","caption":"\u884c\u653f"},"sameAs":["http:\/\/demo3.aiwalls.com\/coinbase"],"url":"https:\/\/cryptonews.uk.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/8067","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=8067"}],"version-history":[{"count":0,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/8067\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/media\/8068"}],"wp:attachment":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=8067"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=8067"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=8067"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}