$285 Million Drained in 12 Minutes

TL;DR

Drift Protocol, the largest decentralized perpetual futures exchange on Solana, was drained of $285 million on April 1, 2026. TRM Labs attributes the attack to North Korean hackers based on on-chain staging patterns, Tornado Cash usage, cross-chain bridging behavior, and laundering speed consistent with previous DPRK operations (Bybit, Ronin Bridge). The attack exploited no code vulnerability. The attacker used social engineering to obtain pre-signed transaction approvals from two of five Security Council multisig members using Solana's durable nonce mechanism, which allows transactions to remain valid indefinitely. The attacker manufactured a fictitious token (CarbonVote/CVT) with seeded liquidity, Drift's oracles treated it as legitimate collateral, and the protocol was drained. On-chain preparation began March 11. Durable nonce accounts were created March 23. The Security Council migration on March 27 (which removed timelocks) was exploited. Execution on April 1 took 12 minutes.

The takeaway

Most stolen funds were bridged to Ethereum within hours.

$285M

Stolen

12min

Execution Time

21 days

Staging Period

2 of 5

Signers Deceived

The Attack Was Not Technical. It Was Human.

Every major DeFi hack in 2025 and 2026 follows the same pattern: the smart contracts hold, and the humans fail. The Bybit hack ($1.4 billion, DPRK, 2025) targeted the signers. The Drift hack ($285 million, likely DPRK, 2026) targeted the signers. The attack surface is not the code. It is the people who approve the transactions.

Drift's Security Council was a standard 2-of-5 multisig, meaning any two of five designated signers could approve administrative actions. The attacker needed two signatures. They got them through what Drift describes as "unauthorized or misrepresented transaction approvals." In plain language: two signers were tricked into signing something they did not fully understand, and the durable nonce mechanism ensured those signatures could be executed weeks later at a time and context the signers never intended.

Durable nonces are the enabler. On Solana, every transaction includes a "recent blockhash" that expires after 60 to 90 seconds. This is a safety feature: if a transaction is not submitted quickly, it becomes invalid. Durable nonces override this expiration. They replace the blockhash with a fixed nonce that keeps the transaction valid indefinitely until someone submits it. Once a signer approves a durable nonce transaction, they cannot revoke that approval unless the nonce account is manually advanced. Most users do not monitor their nonce accounts.

The fabricated collateral is the weapon. The attacker minted approximately 750 million CarbonVote Token (CVT) units, a completely fictitious asset that did not exist before March 12. They seeded it with a few thousand dollars in liquidity and generated fake trading volume through wash trading. Drift's price oracles treated CVT as legitimate collateral worth hundreds of millions of dollars. When the pre-signed transactions executed on April 1, the attacker used this phantom collateral to drain $285 million in real assets from the protocol's vaults.

The Timeline

Figure 01

MAR 11

Staging Begins

10 ETH withdrawn from Tornado Cash. Funds begin moving at approximately 12:00 AM GMT (9:00 AM Pyongyang time). ETH used to fund deployment of CarbonVote Token (CVT). ~750 million CVT minted. Fake liquidity seeded. Wash trading begins to establish price history.
MAR 23

Durable Nonce Accounts Created

Four durable nonce accounts created on-chain. Two associated with legitimate Drift Security Council members. Two controlled by the attacker. This indicates the attacker had already obtained valid pre-signed approvals from two of five council members.
MAR 27 // CRITICAL

Security Council Migration

Drift executes a planned Security Council member swap. The migration removed timelocks on governance actions, eliminating the detection window that would have made intervention possible. The attacker adapts to the new multisig composition.
MAR 30

New Signatures Obtained

A new durable nonce account appears tied to a member of the updated multisig. The attacker has re-obtained the required 2-of-5 approval threshold under the new configuration. All pre-signed transactions are now valid against the current council.
APR 1 // CRITICAL

Execution: 12 Minutes

Drift runs a legitimate test withdrawal from its insurance fund. Approximately one minute later, the attacker submits pre-signed durable nonce transactions. Two transactions, four Solana slots apart: create and approve a malicious admin transfer, then approve and execute. $285 million drained. 41 million JLP tokens moved first, followed by other assets.
APR 1 // POST-EXECUTION

Rapid Laundering

Most stolen funds bridged to Ethereum within hours via Wormhole, NEAR, and Backpack. Laundering speed and cross-chain patterns exceed the pace of the 2025 Bybit exploit. Funds routed through Tornado Cash. TRM Labs and Elliptic both assess DPRK involvement based on on-chain patterns.

Incident Summary

Victim: Drift Protocol (Solana, largest perp futures DEX)
Amount Stolen: ~$285 million
Execution Time: ~12 minutes
Staging Period: March 11 to April 1 (21 days)
Attack Type: Social engineering + durable nonce abuse + fabricated collateral
Smart Contract Exploited: None
Private Keys Compromised: None
Vulnerability: Human (2-of-5 multisig signers deceived)
Fabricated Asset: CarbonVote Token (CVT), ~750M units minted
Initial Funding: 10 ETH via Tornado Cash (March 11)
Attribution: North Korea (assessed by TRM Labs, Elliptic, consistent with DPRK patterns)
Laundering: Bridged to Ethereum via Wormhole, NEAR, Backpack + Tornado Cash
Solana Impact: ~5% SOL price decline
Record: Largest DeFi hack of 2026, 2nd largest Solana exploit ever

Defensive Takeaways

1
Timelocks on Governance Actions Are Not Optional
Drift removed timelocks during a March 27 Security Council migration. This eliminated the detection window that would have allowed the community or security teams to identify and block the malicious transactions before execution. If a timelock had been in place, the pre-signed transactions would have been visible on-chain for a review period before taking effect. Every DeFi protocol, and every organization with multisig governance, should treat timelocks as a non-negotiable security control. The removal of a timelock should trigger the same alarm as disabling MFA on an admin account.
2
Durable Nonces Are a Security Risk Until the Ecosystem Addresses Them
Solana's durable nonce feature was designed for convenience: offline signing, delayed transactions, batch processing. But indefinitely valid transactions are indefinitely exploitable. Once a signer approves a durable nonce transaction, they cannot revoke it without manually advancing the nonce account. Most signers do not monitor their nonce accounts. Any organization using durable nonces in governance or administrative workflows should implement monitoring for nonce account creation and advancement, require explicit review of the full transaction payload before signing, and consider whether the convenience justifies the risk.
3
Multisig Signers Are the Attack Surface
The Drift attacker did not need to compromise keys, break encryption, or exploit code. They needed two people to sign something they did not fully understand. This is the same attack model used in the $1.4 billion Bybit hack. Multisig security is only as strong as the least cautious signer. Organizations using multisig governance should require that all signers use hardware wallets, verify transaction details on the hardware device display (not just the software interface), and receive training on social engineering techniques specific to transaction signing. If a signer cannot explain what a transaction does before signing it, they should not sign it.
4
Oracle Manipulation Through Fabricated Assets Is a Known Attack
The attacker created CarbonVote Token from nothing, seeded it with minimal liquidity, wash-traded to establish a price history, and Drift's oracles treated it as legitimate collateral worth hundreds of millions. Price oracle manipulation through low-liquidity tokens is a well-documented attack vector in DeFi. Protocols should implement minimum liquidity thresholds, price feed diversity requirements, and circuit breakers that halt operations when collateral values spike anomalously. A token that did not exist three weeks ago should not be accepted as collateral for nine-figure positions.
5
DPRK Is Running Parallel Campaigns
In March 2026 alone, North Korea compromised Axios (100M weekly downloads, WAVESHAPER.V2 backdoor) and drained Drift Protocol ($285 million). The Axios staging began March 30. The Drift staging began March 11. These are parallel operations by the same nation-state, running simultaneously against different targets in the same ecosystem. Mandiant's CTO told us on April 1 to expect DPRK credential theft to pivot to cryptocurrency theft. That pivot happened the same day. Any organization that holds cryptocurrency, operates DeFi infrastructure, or employs developers who may have been exposed to the Axios compromise should treat the DPRK threat as active and ongoing.

Atarus Assessment

The Drift Protocol hack is the clearest possible demonstration that in 2026, the most dangerous attackers are not finding bugs in code. They are finding weaknesses in the humans who control the code. North Korea staged this operation for 21 days, created a fictional token, tricked two multisig signers, and executed the entire drain in 12 minutes. The smart contracts worked exactly as designed. The governance model failed because it depended on humans correctly evaluating what they were signing, and they did not. This is the same pattern as Bybit. The same pattern as the blind signing attacks that Ledger's CTO has been warning about. The same pattern that will repeat until the industry stops treating multisig as a security control and starts treating it as what it actually is: a social engineering surface. North Korea stole $2 billion in cryptocurrency in 2025. They are on pace to exceed that in 2026. The Axios supply chain attack and the Drift governance exploit are not separate campaigns. They are two prongs of the same national strategy: compromise the developers who build the ecosystem, then compromise the humans who govern the protocols, and use both to fund weapons programs. The defense is not better code. It is better operational security for the humans who hold the keys.