Drift $280M crypto theft linked to 6-month in-person operation

Drift Protocol experienced a sophisticated, multi-month targeted compromise that resulted in the theft of over $280M; investigators (Drift, Elliptic, TRM Labs) attribute the operation to North Korean-linked UNC4736, which used in-person social engineering at crypto conferences, Telegram communications, a malicious code repository (possible VSCode/Cursor vulnerability), and a malicious TestFlight wallet app to compromise contributors and hijack administrative multisig controls. The protocol is currently frozen and attacker wallets have been flagged across exchanges and bridges.