cyber.hendryadrian.com
Cyber Attack & Data Breach · therecord.media

Drift Confirms $280 Million Stolen; Researchers Link Attack to DPRK

· Original article ↗

Summary

Drift confirmed $280 million was withdrawn after attackers took over security council administrative powers and executed pre-signed transactions. Elliptic and other researchers linked the attack to DPRK actors; Drift is investigating.

Key points

  • Drift confirmed that $280 million was withdrawn during the incident.
  • Drift said the attackers rapidly took over security council administrative powers and executed two pre-signed transactions.
  • Deposits in borrowing and lending features, vaults, and trading were affected; Drift said the incident was not caused by a bug in its programs or smart contracts.
  • Drift said the attack involved compromised transaction approvals and likely sophisticated social engineering, with preparation beginning March 23 and execution on April 1.
  • Elliptic and other researchers attributed the incident to DPRK-linked hackers based on similarities to prior operations; this attribution was not presented as confirmed.
  • Drift is working with security firms, bridges, exchanges, and law enforcement to investigate and trace assets, and plans to release a fuller report.

Article Details

Victim Organization
Drift
Victim Domain
Not disclosed
Incident Type
Cryptocurrency theft involving a rapid takeover of security council administrative powers and execution of pre-signed transactions.
Affected Records
Unknown
Affected Data Size
$280 million in cryptocurrency was withdrawn and reported stolen.
Operational Impact
Deposits in Drift's borrow and lend features, vaults, and trading were affected. Drift said the attacker removed preset withdrawal limits.
Ransom Or Extortion
Unknown
Claim Status
confirmed

Products

Drift Protocol“Drift Protocol is coordinating with multiple security firms to determine the cause of the incident.

Countries

North KoreaOn Thursday morning, experts at blockchain security company Elliptic said the attack on Drift was conducted by hackers based in North Korea.

Industries

Cryptocurrencyhas accused Pyongyang’s government of using the stolen cryptocurrency to fund its military weapons program.Decentralized financeDecentralized finance platform Drift confirmed that $280 million was withdrawn during a sophisticated security incident that involved a rapid takeover of its security council administrative powers and the execution of