Drift Protocol Drained of $285M in 12-Minute Exploit; Investigators Link Operation to UNC4736
Summary
A $285 million exploit drained over half of Drift Protocol’s roughly $550 million in Solana assets on April 1. Investigators linked the six-month operation to DPRK-linked UNC4736; Drift froze protocol functions and coordinated recovery efforts.
Key points
- The April 1 exploit drained about $285 million—more than half of Drift Protocol’s roughly $550 million in assets—in approximately 12 minutes.
- Attackers used durable nonces and pre-signed multisig approvals to seize administrative control; the article says they obtained two of five required signatures through social engineering.
- Attackers created CarbonVote Token (CVT), used wash trading to create a price history, and tricked Drift’s oracles into accepting it as collateral.
- The article describes a six-month infiltration under the guise of a quantitative trading firm, including a malicious TestFlight app and a VSCode/Cursor vulnerability used to compromise devices.
- Investigators attributed the operation to DPRK-linked UNC4736, citing on-chain fund flows and operational overlap with known DPRK-linked personas.
- Stolen assets were swapped into USDC and SOL, partly bridged to Ethereum, and moved through exchanges.
- Drift froze protocol functions, removed the compromised wallet from its multisig, and coordinated with security firms, exchanges, bridges, and law enforcement; a postmortem was expected.
Article Details
- Victim Organization
- Drift Protocol
- Incident Type
- Cryptocurrency protocol exploit involving unauthorized takeover of multisig administrative control and theft of cryptoassets
- Incident Date
- 2026-04-01
- Disclosure Date
- 2026-04-01
- Affected Data Size
- $285 million in cryptoassets
- Operational Impact
- More than half of Drift Protocol's approximately $550 million in total value locked was drained in roughly 12 minutes. Drift froze protocol functions, removed the compromised wallet from the multisig, and coordinated efforts to trace and recover assets. The DRIFT token fell more than 20%.
- Ransom Or Extortion
- Not disclosed
- Claim Status
- confirmed
People
Threat Actors
AppleJeusThe article identifies AppleJeus as another name used to track UNC4736, which investigators attributed the Drift Protocol attack to.Citrine SleetThe article identifies Citrine Sleet as another name used to track UNC4736, which investigators attributed the Drift Protocol attack to.UNC4736Investigators attributed the Drift Protocol attack to this North Korean state-affiliated group, citing on-chain fund flows and operational overlap.
Vendors
Products
CarbonVote Token (CVT)The attackers created a fake token, CarbonVote Token (CVT), and used wash trading to fool price oracles into accepting it as collateral.Cross-Chain Transfer ProtocolStolen assets were consolidated and swapped into USDC and SOL, then partially bridged to Ethereum using Circle’s Cross-Chain Transfer Protocol.CursorAttribution points to DPRK-linked group UNC4736 after a six-month infiltration involving social engineering, a malicious TestFlight app, and a VSCode/Cursor vulnerability.Drift ProtocolThis is not an April Fools joke: a $285 million exploit on April 1 drained over half of Drift Protocol’s roughly $550 million in total value locked on Solana by abusing durable nonces and a fake CarbonVote Token toRaydium(CVT), minting around 750 million units, seeded a small liquidity pool of approximately $500 on the Raydium decentralized exchange, and used wash trading — artificial back-and-forth trades betweenSolanaexploit on April 1 drained over half of Drift Protocol’s roughly $550 million in total value locked on Solana by abusing durable nonces and a fake CarbonVote Token to seize multisig administrative control andTestFlightAttribution points to DPRK-linked group UNC4736 after a six-month infiltration involving social engineering, a malicious TestFlight app, and a VSCode/Cursor vulnerability.VSCodeAttribution points to DPRK-linked group UNC4736 after a six-month infiltration involving social engineering, a malicious TestFlight app, and a VSCode/Cursor vulnerability.