North Koreans hackers likely behind $286 million Drift Protocol exploit: Elliptic

Blockchain analytics firm Elliptic stated on Thursday that the $285 million Drift Protocol exploit, the largest of the year, exhibits multiple indicators of involvement by North Korea's state-sponsored hacker group, the DPRK.

Elliptic's analysis points to on-chain behavior, laundering methodologies, and network-level signals that align with previous attacks attributed to state-linked actors.

Key Developments and Patterns

Drift Protocol, a prominent decentralized perpetual futures exchange on the Solana blockchain, has seen its token price drop over 40% following the incident. If confirmed, this would mark the eighteenth DPRK-linked exploit tracked by Elliptic this year, with over $300 million stolen to date.

The report highlights that this incident is part of the DPRK's ongoing campaign of large-scale cryptoasset theft, which the U.S. government has linked to the funding of its weapons programs. In recent years, DPRK-linked actors are believed to be responsible for billions of dollars in cryptoasset theft.

Elliptic's analysis emphasizes a familiar operational pattern, suggesting the activity was premeditated and carefully staged, involving early test transactions and pre-positioned wallets before the main exploit.

Following the exploit, funds were rapidly consolidated, swapped, bridged across different blockchains, and converted into more liquid assets. This reflects a structured, repeatable laundering flow designed to obscure the origin of the funds while maintaining control.

Technical Challenges and Cross-Chain Laundering

A significant challenge in tracing these activities, particularly on Solana, is its account model. Because each asset is held in a separate token account, an actor's activity can appear fragmented across multiple addresses. Elliptic's report notes that without linking these accounts, investigators may only see partial views of the attacker's actions.

Elliptic's clustering approach helps connect these disparate token accounts back to a single entity, providing a critical entity-level view, especially in incidents involving numerous asset types. The firm also stressed that laundering has become inherently cross-chain, with funds moving from Solana to Ethereum and other networks, underscoring the need for holistic cross-chain tracing capabilities.

Background on DPRK Crypto Theft

This analysis follows a December Chainalysis report that revealed DPRK hackers stole a record $2 billion in crypto in 2025, including a $1.4 billion breach of Bybit. This represented a 51% increase from the previous year. The U.S. Treasury Department has previously stated that North Korea uses stolen assets to fund its weapons of mass destruction program.