North Korean State Actors Linked to Massive $285 Million Drift Protocol Heist

On April 1, 2026, attackers drained roughly USD 285 million from Drift Protocol (a Solana perpetual futures exchange) by manufacturing a fake asset (CarbonVote Token, CVT), building a deceptive price history via wash trading, manipulating oracles to accept CVT as collateral, and using social engineering to get Security Council members to pre-sign transactions; the removal of timelocks and use of Solana durable nonces enabled fast withdrawals and bridging to Ethereum, TRM Labs attributes the incident to North Korean actors and Drift has since suspended operations with DRIFT token plunging over 40%.