North Koreans? The Drift Protocol Mysteries Revealed!

Elliptic, that peculiar sorcerer of blockchain sorcery, whispers that the North Korean shinies might have orchestrated the Drift Protocol heist.

The brass knuckles of the evidence pointed the rogue Sphinx’s eyes to three vaults of destiny: the JLP Delta Neutral, the SOL Super Staking, and the BTC Super Staking – a trifecta that would make a vodka-soaked bard swoon.

Humorously, the wallet in question sprang to life a mere eight days before the incident, winking with a minuscule test transaction from a Drift vault-clearly a master plan written in the margins of an inverted cross‑chain Telegram.

“All parties involved in this operetta have been identified. Drift is now broadcasting an on‑chain note from the cryptic address 0x0934faC45f2883dd5906d09aCfFdb5D18aAdC105 to the ETH wallets that harbor the stolen spoils.”

Wallet 1: 0xAa843eD65C1f061F111B5289169731351c5e57C1 (Timestamp…)

– Drift (@DriftProtocol) April 3, 2026

The pilfered treasure was promptly metamorphosed into USDC and then executed a daring hop from Solana to Ethereum, as if a drunk wizard had tossed a coin into a portal and it landed in a different kingdom.

“The on‑chain choreography, laundering rituals, and network-level breadcrumbs match the playbook of North Korean hoodlums observed in the past.”

TRM Labs, another cackling chess‑master, also pointed fingers at Pyongyang’s mischievous minions. Their card trick involved once again the mystical Tornado Cash, the hasty launch of CarbonVote at 09:30 Pyongyang local time, and a cross‑chain peregrination that could have been a poorly scripted dance performance.

“The use of Tornado Cash for initial staging, the deployment timing of the CarbonVote token at 09:30 Pyongyang time, the cross‑chain bridging patterns, and the speed and scale of post‑hack laundering – all align closely with techniques observed in prior DPRK‑attributed hacks, including the Bybit exploit of 2025.”

On April 1, the Solana‑based perpetual futures platform became the stage for the year’s biggest DeFi fiasco, a calamity that has now spilled onto 20 other projects like a crimson stain on a patient tapestry.

Follow us on X to get the latest news as it unfolds-yes, we keep the gossip alive.

🚨New: @DriftProtocol exposure tracker updated with more Solana projects confirming impact from the $285M exploit.

– SolanaFloor (@SolanaFloor) April 2, 2026

If this conspiracy turns tide into fact, it would be the 18th DPRK association in a year where Elliptic has counted more than $300 million in liquidated nightmares. These nocturnal thieves have allegedly absconded with a staggering $6.5 billion in crypto goodness over recent years, as Elliptic would tell the impatient accountants.

A Chainalysis scroll comes from the ether, saying that North Korean marauders plundered a record $2.02 billion in 2025 alone, a 51% surge from the previous year-lending no room for pause, other than to gulp down the stale air of the last year’s “Bybit” debacle.

Read More

2026-04-03 12:59