North Korean Hackers: The $286 Million Vanish-o-Rama!

by

Finance

What ho, old sport! Here’s the lowdown:

  • Elliptic, those eagle-eyed blockchain sleuths, reckon the $285 million Drift Protocol caper has all the hallmarks of our old chums, the North Korean DPRK hackers. Jolly good show, what?
  • Their analysis reveals a spot of premeditated skulduggery, with onchain antics and laundering tactics that scream “Pyongyang’s finest.”
  • Solana’s account model, it seems, is as fragmented as Bertie Wooster’s brain after a night at the Drones Club, making investigations a bit of a pickle.

Elliptic chimed in on Thursday, declaring the Drift Protocol exploit-the largest this year, don’t you know-to be a likely DPRK operation. “Multiple indicators,” they said, with all the gravitas of Jeeves announcing breakfast.

The firm pointed to onchain shenanigans, laundering methods, and network signals that align with previous DPRK-linked japes. It’s all rather like recognizing Aunt Agatha’s handwriting on a particularly stern letter.

Drift Protocol, whose token has taken a nosedive to $0.06, is the top dog in decentralized perpetual futures on the Solana blockchain. Poor chaps, they’ve had a bit of a rough trot.

“If confirmed,” Elliptic trilled, “this would be the eighteenth DPRK escapade we’ve spotted this year, with over $300 million pinched so far. It’s all part of their grand scheme to fund their fireworks display-I mean, weapons programs.”

Hours earlier, Arkham data showed the funds doing the old hop, skip, and jump from Drift to an interim wallet, then scattering like Bertie’s excuses after a mishap.

In December, Chainalysis revealed DPRK hackers had nabbed a record $2 billion in 2025, including the $1.4 billion Bybit heist. The U.S. Treasury Department insists these funds are fueling North Korea’s penchant for dramatic explosions.

Elliptic’s analysis, rather than dwelling on the exploit itself, highlights a familiar modus operandi. The whole affair was “premeditated and carefully staged,” with test transactions and pre-positioned wallets-rather like laying out one’s best trousers before a big night out.

Once the deed was done, the funds were consolidated, swapped, bridged across chains, and converted into liquid assets faster than Jeeves can mix a martini. A structured, repeatable laundering flow, designed to obscure origins while keeping control.

The real spanner in the works, Elliptic notes, is Solana’s account model. With each asset in its own token account, an attacker’s activity can look as scattered as Bertie’s thoughts after a few too many. Without clustering these accounts, investigators risk missing the forest for the trees.

Enter Elliptic’s clustering approach, which connects token accounts back to a single entity, providing a holistic view. In a case involving more than a dozen asset types, this entity-level perspective is as essential as a stiff drink after a run-in with Aunt Agatha.

The report also underscores how laundering has gone cross-chain, with funds leaping from Solana to Ethereum and beyond. It’s all rather like a game of musical chairs, but with millions at stake.

Read More

2026-04-02 18:21