Drift Post-Mortem Links $280 Million Crypto Theft to North Korean-Linked Social Engineering Operation
Summary
Drift says a months-long social-engineering operation using fabricated trading-firm identities culminated in an April 1 theft of more than $280 million. Investigators linked it to UNC4736; malicious TestFlight and code-repository vectors remain possible.
Key points
- Drift says the theft of more than $280 million on April 1 followed roughly six months of relationship-building by people posing as a quantitative trading firm.
- The operation used constructed professional identities and in-person meetings with Drift contributors at industry conferences.
- Drift said a contributor may have been compromised through a code repository shared by the group; another may have downloaded a malicious TestFlight app.
- Investigators linked the operation to North Korean state-affiliated UNC4736, also known as AppleJeus or Citrine Sleet; attribution is reported, not presented as independently confirmed.
- The trading group scrubbed its Telegram chat with Drift after the theft, which the article describes as a key piece of evidence.
- Drift is working with law enforcement and Mandiant; its functions have been frozen and the attacker’s wallets flagged across exchanges and bridge operators.
- Investigators linked the operation to the 2024 Radiant Capital theft based on fund destinations and overlaps in personas.
Article Details
- Victim Organization
- Drift
- Incident Type
- Cryptocurrency theft following a months-long social engineering operation. A contributor may have been compromised through a code repository shared by the trading group or a potentially malicious TestFlight app; these vectors remain unconfirmed.
- Incident Date
- 2026-04-01
- Operational Impact
- Drift froze all functions. The article reports that more than $280 million was stolen and that the attacker’s wallets were flagged across multiple exchanges and bridge operators.
- Claim Status
- confirmed
People
Threat Actors
AppleJeusThe Drift operation was linked to AppleJeus, which the source describes as another name for UNC4736 and as an operation associated with North Korean cyber activity.Citrine SleetThe source identifies Citrine Sleet as Microsoft’s name for AppleJeus and links the Drift operation to that activity.UNC4736The Drift operation was linked by investigators to this North Korean state-affiliated group; the source also identifies it with AppleJeus and Citrine Sleet.
Malware
Vendors
Products
Salesloft DriftThe Drift cryptocurrency platform disclosed a months-long, in-person social engineering operation that culminated on April 1 with the theft of more than $280 million.TelegramUNC4736 and the AppleJeus/Citrine Sleet operation—used fabricated professional identities, Telegram communications, and likely malicious TestFlight and code-repository vectors to compromise contributorsTestFlightSleet operation—used fabricated professional identities, Telegram communications, and likely malicious TestFlight and code-repository vectors to compromise contributors and exfiltrate funds.
Countries
Industries
CryptocurrencyThe Drift cryptocurrency platform disclosed a months-long, in-person social engineering operation that culminated on April 1 with the theft of more than $280 million.fintechGoogle’s Threat Analysis Group published a report in 2022 on Operation AppleJeus, which involved the same exploit kit being used to target more than 85 users in the cryptocurrency and fintech industries.