North Korean Hackers Pose as Trading Firm to Steal $285M from Drift

Drift Protocol revealed a $285M theft on April 1, 2026, carried out by a North Korean-linked group (UNC4736) that spent six months cultivating a false partnership, used social engineering and supply-chain-style tactics (malicious TestFlight app, cloned repo, exploiting developer tools) to compromise multisig approvals, and executed a durable-nonce exploit to rapidly drain vaults; investigators linked fund flows to a prior Radiant Capital breach and the protocol has since frozen functions and removed compromised wallets.