Solana Co-Founder Calls North Korean Hack ‘Terrifying’ – Here’s How They Did It

by

In a tale straight out of a spy novel, Solana’s co-founder, Anatoly Yakovenko, had the audacity to describe the Drift Protocol hack as “terrifying.” Well, no kidding, Anatoly. It turns out this hack wasn’t just some amateur script kiddies stumbling across a vulnerability – oh no, this was the result of a meticulously orchestrated social engineering attack that involved the North Koreans, because apparently, their hacking hobby doesn’t stop at missile tests.

Drift Protocol, once a beacon of Solana’s decentralized finance, now lies in shambles after a jaw-dropping $270 million was siphoned off. The hack was so colossal that the protocol had no choice but to halt deposits and withdrawals. For those who might’ve thought it was just another elaborate April Fools’ joke – surprise! It wasn’t. Not even remotely close.

Six Months of Cunning and Deception

The intricacies of this heist are the stuff of legend. According to reports, the perpetrators didn’t just sit in a dark room playing on their laptops. No, they went full method-acting. They physically stalked Drift’s developers, attending crypto conferences and gaining their trust. A slow burn. A six-month-long campaign that would make even the most seasoned conman raise an eyebrow.

HOT Stories

‘Terrifying’: Solana Founder Reacts to One of Biggest DeFi Hacks in History

Shiba Inu (SHIB) Never Left Downtrend, Midnight (NIGHT)’s Fundamental Support Is In, What Are Three XRP Factors Needed for Bullish Reversal? Crypto Market Review

Whispers in the digital alleyways point the finger squarely at a North Korean state-sponsored group. Yes, the same country that’s apparently not content with just its nuclear aspirations – now it’s dabbling in the world of DeFi hacks. From late 2025 onward, unsuspecting Drift contributors found themselves courted by third-party intermediaries, who, of course, were not North Korean nationals – because why would you suspect anything if it wasn’t the ‘right nationality’? These intermediaries presented themselves as a legitimate quantitative trading firm looking to integrate with Drift.

In what could only be described as an elaborate ruse, the attackers infiltrated Drift, onboarding an Ecosystem Vault between December 2025 and January 2026 with over $1 million of their own capital. The trust, carefully cultivated over months, became the perfect soil for their malicious seeds to sprout.

By early 2026, the attackers had already wormed their way into Drift’s inner workings, meeting with contributors at international conferences, discussing technical matters, and generally acting like part of the team. Who could’ve imagined the quiet North Koreans were just playing the long game, letting their victims trust them before finally striking?

And strike they did. In April 2026, the attackers shared links to supposed projects they were building. Of course, one unsuspecting contributor cloned a repository – which contained a vulnerability in the VSCode and Cursor text editors, something that only the most astute would have noticed. The trap was set. Another contributor downloaded a fake TestFlight application, because who doesn’t trust a well-crafted piece of software?

And just like that, the attackers scrubbed their tracks. Telegram chats? Gone. Malicious software? Wiped clean. A perfect crime, leaving only the shattered trust of a protocol and the stunned silence of the crypto community.

Read More

2026-04-05 10:10