‘It reads like a spy novel’: $280 million theft from Drift involved North Korean fake companies, cutouts

The Drift cryptocurrency platform published a post‑mortem attributing a sophisticated, months‑long social‑engineering and malware‑enabled theft of more than $280M to North Korean state‑linked UNC4736 (AppleJeus/Citrine Sleet); attackers built long‑term trust via in‑person meetings and Telegram, likely delivered malicious software (TestFlight app or compromised code repo), and the operation is tied to prior crypto heists while investigations and mitigation actions are ongoing.