Drift's Post-Mortem Is Out | Atarus Research

TL;DR

Drift Protocol's post-mortem reveals the $285M hack was a structured intelligence operation by UNC4736 (AppleJeus/Citrine Sleet), beginning fall 2025. Operatives posed as a quant trading firm, met Drift contributors in person at multiple conferences, deposited $1M+, onboarded an Ecosystem Vault, and spent months building trust. Two compromise vectors identified: (1) a contributor was persuaded to install a malicious wallet app via Apple TestFlight, bypassing App Store security review, and (2) a contributor cloned a malicious code repository that exploited a known VSCode/Cursor vulnerability allowing arbitrary code execution upon opening. These compromises gave the attackers the multisig approvals needed. On April 1, they executed 31 rapid withdrawals in 12 minutes using pre-signed durable nonce transactions. SEAL 911 attributes with medium-high confidence based on on-chain fund flows tracing to the Radiant Capital attackers. Mandiant is conducting the forensic investigation.

The takeaway

Communication logs and malicious tools were wiped immediately after execution.

6mo

Operation Duration

$1M+

Deposited as Cover

$285M

Stolen

12min

Execution Time

The Six-Month Infiltration

The operation began in fall 2025 at a major crypto conference, where individuals presenting themselves as a professional quantitative trading firm approached Drift contributors. They were polished, knowledgeable, and asked the right questions. Over the following months, they met Drift team members face-to-face at multiple industry events across several countries. These were not video calls or Telegram messages. These were in-person relationships built over handshakes, dinners, and conference hallways.

Between December 2025 and January 2026, the group onboarded an Ecosystem Vault on Drift. This required filling out a form with strategy details, holding multiple working sessions with contributors, and depositing over $1 million of their own capital. This was not a typical phishing operation that costs nothing to execute. The attackers invested real money, real time, and real human presence to build a functioning operational identity inside the Drift ecosystem.

Through February and March 2026, integration conversations continued. The group shared links to projects, tools, and applications they claimed to be developing. These interactions served dual purposes: maintaining the cover story and delivering the malware that would compromise the multisig signers' devices.

The individuals who appeared in person were not North Korean nationals. DPRK operations at this level deploy third-party intermediaries with fully constructed identities, employment histories, and professional networks designed to withstand due diligence. The people Drift met at conferences were cutouts. The operators behind them were UNC4736.

The Compromise Vectors

Drift's investigation identified two likely intrusion pathways, both delivered through the trust relationship the attackers had spent months building.

Vector 1: Malicious TestFlight app. A Drift contributor was persuaded to download a mobile application via Apple's TestFlight platform, which the group presented as their new wallet product. TestFlight is Apple's system for distributing pre-release apps. It bypasses App Store security review entirely. The malicious app gave the attackers access to the contributor's device.

Vector 2: Weaponized code repository. A contributor was induced to clone a repository the group presented as a tool for building a frontend interface for their vault. The repository exploited a known vulnerability in VSCode and Cursor, two of the most widely used code editors, that the security community had been flagging since late 2025. Simply opening the folder in either editor was sufficient to execute arbitrary code and compromise the machine without any warning or user prompt.

Once the contributors' devices were compromised, the attackers obtained the multisig approvals needed to control the protocol. They created durable nonce accounts, pre-signed the transactions, and waited for the optimal execution window. On April 1, they submitted 31 rapid withdrawals in approximately 12 minutes. Communication logs and malicious tools were wiped immediately after execution.

The Attribution Chain

Drift attributes the attack with medium confidence to UNC4736, a North Korean state-affiliated group also tracked as AppleJeus, Citrine Sleet, Golden Chollima, and Gleaming Pisces. The SEAL 911 security team assessed with medium-high confidence that the same actors carried out the October 2024 Radiant Capital hack ($53 million), which Mandiant previously attributed to UNC4736. On-chain fund flows and operational persona overlaps link the two campaigns.

UNC4736 is best known for the X_TRADER/3CX supply chain breach in 2023, one of the most sophisticated supply chain attacks ever documented, where a compromised trading application led to the compromise of 3CX's enterprise phone software, which in turn was used to target cryptocurrency companies. The Drift attack follows the same strategic logic: infiltrate the ecosystem through trust, compromise the humans who control access, and extract cryptocurrency to fund the regime's weapons programs.

CrowdStrike described Golden Chollima in January 2026 as an offshoot of Labyrinth Chollima that targets small fintech firms to generate baseline revenue for the DPRK regime. Despite improving trade relations with Russia, North Korea "requires additional revenue to fund ambitious military plans that include constructing new destroyers, building nuclear-powered submarines, and launching additional reconnaissance satellites."

Two DPRK Groups, Two Attack Models, Same Month

March 2026 saw two separate North Korean cyber operations hit the cryptocurrency and open source ecosystems simultaneously.

UNC1069 compromised Axios (100 million weekly downloads) on March 31 using the WAVESHAPER.V2 backdoor, targeting developer machines and CI/CD environments. This was a supply chain attack designed to harvest credentials at scale. Google attributed the attack on April 1.

UNC4736 spent six months infiltrating Drift Protocol through in-person social engineering, deposited $1 million, compromised multisig signers through malware delivered via TestFlight and a weaponized code repository, and drained $285 million on April 1.

These are different groups, different attack models, and different objectives running in parallel. UNC1069 operates at scale through supply chain compromise. UNC4736 operates through deep, targeted human intelligence operations. Both serve the same strategic purpose: generating revenue for the North Korean regime. The DPRK is not running a single cyber campaign. It is running an industrial-scale cryptocurrency theft operation with multiple specialized teams operating concurrently.

Defensive Takeaways

1
Your Due Diligence Cannot Detect This
The attackers met the team in person, deposited real capital, participated in legitimate working sessions, and maintained the relationship for six months. Standard background checks, reference calls, and AML/KYC procedures would not have flagged intermediaries with constructed identities and real money. The uncomfortable lesson is that traditional due diligence is insufficient against a nation-state willing to invest months and millions of dollars in a cover operation. The defense must move beyond identity verification to operational security: isolating contributor devices, restricting what applications can be installed, and treating every external relationship as a potential attack vector regardless of its duration or apparent legitimacy.
2
Apple TestFlight Is Not a Secure Distribution Channel
TestFlight bypasses App Store security review entirely. It is designed for beta testing, not for receiving applications from external partners. Any application distributed through TestFlight should be treated as untrusted code. Organizations that handle high-value assets should prohibit TestFlight installations on devices that have access to signing keys, multisig wallets, or administrative credentials. This is a simple policy control that would have blocked one of the two compromise vectors.
3
The VSCode/Cursor Vulnerability Is a Known Risk
The security community flagged this vulnerability in late 2025: simply opening a folder or file in VSCode or Cursor can trigger arbitrary code execution without user interaction. The attackers exploited this to compromise a contributor who cloned their repository. If you use VSCode or Cursor (and most developers do), ensure you are running updated versions with workspace trust enabled. Never clone and open repositories from external parties on machines that have access to signing keys, wallets, or production credentials. Use isolated development environments for untrusted code.
4
Every Device That Touches a Multisig Is a Target
Drift's post-mortem explicitly warns: "treat every device that touches a multisig as a potential target." The attackers did not need to compromise all five signers. They needed two. And they got those two by compromising the personal devices of contributors through socially delivered malware. The defense is hardware signing with on-device transaction verification, isolated signing devices that are never used for email, browsing, or application installation, and mandatory review of full transaction details on the hardware device before approval. If a signer cannot see exactly what they are signing on the hardware display, they should not sign.
5
This Is Not a DeFi Problem. This Is an Enterprise Problem.
Replace "quantitative trading firm" with "consulting partner," "software vendor," or "potential client." Replace "Drift contributor" with "senior engineer," "finance director," or "executive assistant." Replace "multisig wallet" with "corporate bank account," "AWS root credentials," or "domain admin." The attack model is identical: build a relationship through legitimate channels over months, deliver malware through that trusted relationship, use the compromised access to steal high-value assets. If North Korea is willing to spend six months and a million dollars to infiltrate a DeFi protocol, they will spend the same to infiltrate a mid-size company with valuable assets. The difference is that the DeFi protocol published a post-mortem. Most companies would not.

Atarus Assessment

Drift's post-mortem describes the most sophisticated social engineering operation ever documented against a DeFi protocol, and one of the most sophisticated social engineering operations documented against any target. Six months of relationship building. In-person meetings across multiple countries. $1 million in deposited capital. A fully functioning operational identity inside the target ecosystem. And when the moment came, 12 minutes of execution followed by immediate evidence destruction. The attackers were not hackers in the traditional sense. They were intelligence operatives running a cover operation with state resources, fabricated identities, third-party intermediaries, and the patience to wait half a year for the payoff. The $285 million stolen from Drift will fund North Korean military programs. The lesson for every organization is the same one we have been writing about all month: the most dangerous attacks do not exploit code. They exploit trust. The Trivy supply chain attack exploited trust in security tooling. The Axios compromise exploited trust in open source maintainers. The Drift hack exploited trust in a business partner who showed up at conferences, deposited real money, and looked exactly like a legitimate counterparty. Your organization has relationships like this. Partners, vendors, clients, and collaborators who have earned your trust over time. The question Drift's post-mortem forces you to ask is: what would happen if one of those relationships was not what it appeared to be?