North Korean hackers infiltrate Solana perpetual protocol: DeFi security shifts focus from code to people

SnapshotBot · 2026-04-05T13:35:00+00:00

Drift confirms a loss of $285 million, highlighting the threat of social engineering attacks to the crypto market and prompting reflection on the "trustless" narrative of DeFi. Attackers infiltrate by establishing trust, requiring a reassessment of security measures. Market confidence in DeFi has declined, raising concerns about stablecoins and other protocols. Strategies should be adjusted proactively to counter the spread of North Korean hacker tactics.

SnapshotBot

2026-04-05 13:35:00

Abstract generation in progress

Social engineering isn’t tearing through code—it’s tearing through people

Drift has confirmed it lost $285 million. But beyond the numbers, what’s more worth关注ing is that Solana’s perpetual ecosystem has been targeted by a patient, nation-state-level adversary. Market attention is shifting from “whether the code has bugs” to “whether people will be fooled.”

A seemingly routine meeting-based social engagement ultimately turned into a six-month-long infiltration. Actors like UNC4736 don’t rush to find vulnerabilities—they’re cultivating relationships. After this story spread across crypto social media, people began reexamining DeFi’s “trustless” narrative—because when it comes to targeted social engineering, that storyline is actually fragile. There’s overlap between on-chain fund movement and the 2024 Radiant attack, and it matches Mandiant’s earlier analysis that attributed a similar path to North Korea.

The market is indeed panicking, but it hasn’t spun out of control: the Fear and Greed Index has dropped to 11, and BTC and ETH are basically holding steady (NUPL 0.196, funding rates neutral), with no cascade of major coins. Even though some are calling for “capital flight,” from March to April Solana DeFi TVL still stayed near $100B+. DRIFT itself is down 40% to $0.034 (market cap $34 million). The attackers still have about $552k in USDY and some meme coins. The top ten holder addresses (together 58%) show no obvious signs of distribution; they look like they’re waiting for forensic conclusions rather than rushing to run.

The attackers moved 232 million USDC out via CCTP, and Circle couldn’t freeze it in time. Why not route through Tether? Maybe they’re betting that Circle will respond slowly.
A “Circle Files” post from ZachXBT triggered a backlash. People started discussing whether the stablecoin issuer has become a “choke point.” The loss in the nine figures is right there, and calls for decentralized alternatives have grown louder again.
Other Solana protocols have also temporarily frozen funds before, but this time TVL holding steady suggests traders are temporarily treating Drift as an exception. That view may change.

Camp	Their evidence	What happens if they’re right	My take
People questioning the North Korea attribution	Elliptic only says it’s “possibly related” based on money-laundering trails; Mandiant’s forensics isn’t finished yet.	This gets downgraded into ordinary hacker noise, and the urgency around multisig and permission architecture drops.	Too much doubt. The on-chain overlap gives a confidence level that’s not low. There’s no need to wait—strengthen defenses now using the North Korea threat model.
People criticizing Circle’s slow response	ZachXBT said that since 2022 there have been $420 million+ losses that haven’t been frozen; this time the CCTP action was delayed by about 6 hours.	Trust in centralized stablecoins declines, and some capital may rotate into USDT or DAI, warming up the “DeFi purity” narrative.	Explanatory power is limited. The attackers chose CCTP precisely because they expected a slow response; the correct move is to isolate admin keys—not just to blame the issuer.
People bearish on Solana DeFi	DRIFT plunges, a dozen-plus protocols get affected, and the Fear Index is 11.	Bet on capital fleeing outside and short SOL perps, treating this as a trust break.	Too early to draw the conclusion. TVL is steady, and the lack of broad selling suggests resilience remains. An underappreciated audited DEX (e.g., Aevo) could become a rotation target.
Bullish camp betting on recovery	Drift cooperates with law enforcement, related wallets have been flagged, and there’s no new outflow.	The recovery narrative buys time; some funds snipe DRIFT, flipping once the forensics results come back.	Optimistic to a point that’s a bit aggressive. With 58% of holdings concentrated, if a whale bails, it can trigger a waterfall. I’ll wait for Mandiant to confirm the attribution before saying more.

This isn’t an occasional incident—it’s a reusable attack playbook

Calling the takeover of Drift’s admin keys an “isolated incident” misses the key points: disguising as a quantitative trader, deep offline socializing, and building trust for half a year. This isn’t a random event—it’s a standard, documented process from the North Korean hackers’ toolkit.

The “just audit the code more rounds” advice misses the point. Attack vectors like a VSCode supply chain and TestFlight app诱导 can completely bypass the technical defenses themselves. I’ll reduce exposure to Solana perpetual protocols that haven’t done sufficient due diligence, and I’ll favor chains that are more mature in governance processes and identity verification—like the Ethereum DAO ecosystem. Mandatory KYC for integrated partnerships will almost certainly be rolled out, and the market hasn’t priced that in yet.

Bottom line: If you treat this as old news, you’re already behind. Get ready for the spread of North Korea methods and expect Solana yields to be eroded by 20–30%. Teams using multisig with air-gapped setups will gain an edge. If you like contrarian trading, you can look for a rebound during extreme fear (index < 10). But if you’re a long-term holder? Before attribution is fully nailed down and the whole ecosystem is forced to upgrade, consider switching early to a leading L1 chain that’s survived many cycles.

Verdgment: This is an “early but accelerating” narrative. Adjustments now beat passive waiting. The real beneficiaries are teams and professional funds that can quickly implement permission minimization, air-gapped multisig, and process-driven KYC; tactical traders can capture rebounds amid extreme fear; but those who passively hold long-term without rotating based on on-chain and protocol quality will be at a disadvantage.

SOL-1,3%

DRIFT31,83%

RDNT-2,23%

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.

1 Likes