Drift Says $285 Million Theft Followed Six-Month DPRK-Linked Social Engineering Operation
Summary
Drift says the April 1, 2026 theft of $285 million followed a six-month social engineering operation, attributed with medium confidence to UNC4736. Suspected entry points included a malicious VS Code project and a fraudulent TestFlight wallet.
Key points
- Drift said the April 1, 2026 theft was the culmination of a targeted operation that began in fall 2025.
- Drift attributed the operation with medium confidence to UNC4736, also known as AppleJeus, Citrine Sleet, Golden Chollima and Gleaming Pisces.
- The suspected actors built trust through conference meetings, Telegram conversations and an Ecosystem Vault onboarding that included depositing more than $1 million.
- Drift described two suspected entry points: a shared repository containing a malicious VS Code tasks.json file and a fraudulent wallet app offered through TestFlight.
- Drift said on-chain fund flows used to stage and test the operation traced back to the Radiant Capital attackers, while campaign personas overlapped with known DPRK-linked activity.
Article Details
- Victim Organization
- Drift
- Incident Type
- Cryptocurrency theft following a months-long social-engineering operation. Drift said likely initial vectors included a malicious VS Code project and a fraudulent TestFlight wallet app.
- Incident Date
- 2026-04-01
- Affected Data Size
- $285 million in cryptocurrency
- Operational Impact
- Drift reported the theft of $285 million and said it was working with law enforcement and forensic partners to reconstruct the incident.
- Ransom Or Extortion
- Not disclosed for the Drift incident.
- Claim Status
- confirmed
Threat Actors
AndarielDomainTools Investigations associated Andariel with the DPRK's disruptive track involving ransomware and wiper malware; the article does not connect Andariel to the Drift incident.AppleJeusThe article identifies AppleJeus as another tracking name for UNC4736, which Drift attributed to the attack with medium confidence.Citrine SleetThe article identifies Citrine Sleet as another tracking name for UNC4736, which Drift attributed to the attack with medium confidence.Gleaming PiscesThe article identifies Gleaming Pisces as another tracking name for UNC4736, which Drift attributed to the attack with medium confidence.Golden ChollimaThe article identifies Golden Chollima as another tracking name for UNC4736, which Drift attributed to the attack with medium confidence. CrowdStrike described Golden Chollima as targeting cryptocurrency theft.KimsukyDomainTools Investigations associated Kimsuky with the DPRK's espionage-oriented malware track; the article does not connect Kimsuky to the Drift incident.Lazarus GroupDomainTools Investigations described Lazarus Group as leading efforts to generate illicit revenue for the DPRK; the article does not connect it to the Drift incident.UNC4736Drift attributed the attack to UNC4736 with medium confidence. The article says UNC4736 is also tracked under the names AppleJeus, Citrine Sleet, Golden Chollima, and Gleaming Pisces.
Malware
DEV#POPPERSome of these efforts have used weaponized Node.js projects hosted on GitHub to deploy a JavaScript backdoor called DEV#POPPER RAT and an information stealer known as OmniStealer.OmniStealerSome of these efforts have used weaponized Node.js projects hosted on GitHub to deploy a JavaScript backdoor called DEV#POPPER RAT and an information stealer known as OmniStealer.
Vendors
Products
GitHubSome of these efforts have used weaponized Node.js projects hosted on GitHub to deploy a JavaScript backdoor called DEV#POPPER RAT and an information stealer known as OmniStealer.Salesloft DriftDrift says the April 1, 2026 theft of $285 million was the culmination of a months-long, targeted social engineering operation by DPRK-linked actors who built trust through in-person meetings, Telegram groups, and aSolanaThe Solana-based decentralized exchange described it as “an attack six months in the making,” attributing it with medium confidence to a North Korean state-sponsored hacking group dubbed UNC4736, which is also trackedTelegramtargeted social engineering operation by DPRK-linked actors who built trust through in-person meetings, Telegram groups, and a fake trading firm.TestFlightThe campaign deployed supply-chain tactics (a malicious VS Code project and a fraudulent TestFlight wallet), showed on-chain links to the Radiant Capital attackers, and aligns with a broader DPRK strategy of fragmentedVS CodeThe campaign deployed supply-chain tactics (a malicious VS Code project and a fraudulent TestFlight wallet), showed on-chain links to the Radiant Capital attackers, and aligns with a broader DPRK strategy of fragmented
Countries
Canadathat’s primarily geared towards cryptocurrency theft by targeting small fintech firms in the U.S., Canada, South Korea, India, and Western Europe.ChinaThe state-sponsored program deploys thousands of technically skilled workers in countries like China and Russia, who connect to company-issued laptops hosted at laptop farms in the U.S.Indiageared towards cryptocurrency theft by targeting small fintech firms in the U.S., Canada, South Korea, India, and Western Europe.IranNew evidence unearthed by Flare has since revealed the campaign’s efforts to actively recruit individuals from Iran, Syria, Lebanon, and Saudi Arabia, with at least two Iranians receiving formal offer letters from U.S.IrelandFacilitators have also been found to use LinkedIn to hire separate people from Iran, Ireland, and India, who are then coached to land the jobs.LebanonNew evidence unearthed by Flare has since revealed the campaign’s efforts to actively recruit individuals from Iran, Syria, Lebanon, and Saudi Arabia, with at least two Iranians receiving formal offer letters from U.S.North KoreaNorth Korea’s Fragmented Malware EcosystemRussia“Despite improving trade relations with Russia, the DPRK requires additional revenue to fund ambitious military plans that include constructing new destroyers, building nuclear-powered submarines, and launchingSaudi ArabiaNew evidence unearthed by Flare has since revealed the campaign’s efforts to actively recruit individuals from Iran, Syria, Lebanon, and Saudi Arabia, with at least two Iranians receiving formal offer letters from U.S.South Koreaprimarily geared towards cryptocurrency theft by targeting small fintech firms in the U.S., Canada, South Korea, India, and Western Europe.SyriaNew evidence unearthed by Flare has since revealed the campaign’s efforts to actively recruit individuals from Iran, Syria, Lebanon, and Saudi Arabia, with at least two Iranians receiving formal offer letters from U.S.United StatesChollima that’s primarily geared towards cryptocurrency theft by targeting small fintech firms in the U.S., Canada, South Korea, India, and Western Europe.
Industries
CryptocurrencyThe DPRK now employs a fragmented malware ecosystem and multinational IT-worker fraud to steal cryptocurrency and funnel revenue to the regime.Defensedefense contractors, cryptocurrency exchanges, and financial institutions,” Flare said.fintechoffshoot of Labyrinth Chollima that’s primarily geared towards cryptocurrency theft by targeting small fintech firms in the U.S., Canada, South Korea, India, and Western Europe.