Elliptic has identified multiple indicators suggesting that the exploit of Drift Protocol is linked to the Democratic People’s Republic of Korea (DPRK).
Drift Protocol, the largest decentralized perpetual futures exchange on the Solana blockchain, experienced a major security incident on April 1, 2026. Elliptic calculated that the combined value of assets stolen in this exploit was $286 million. The on-chain behavior, laundering methodologies and network-level indicators associated with the attack are consistent with techniques observed in previous DPRK-attributed operations.
If confirmed, this incident would represent the eighteenth DPRK act Elliptic has tracked this year, with over $300 million stolen so far. It is a continuation of the DPRK’s sustained campaign of large-scale cryptoasset theft, which the US government has linked to the funding of its weapons programs. DPRK-linked actors are believed to have stolen over $6.5 billion dollars in cryptoassets in recent years.
This latest incident also takes place amid a broader escalation of DPRK-linked activity targeting the crypto ecosystem, including the recent supply chain compromise of the Axios npm package, which Google attributed to DPRK threat actor UNC1069.
How did the Drift Protocol attack unfold?
Within an hour of the attack beginning, the attacker systematically drained the vast majority of Drift’s liquidity by withdrawing assets from multiple protocol vaults. According to blockchain security firm PeckShield, the preliminary cause appears to be a compromise of the protocol’s administrator private keys, which gave the attacker privileged access to initiate withdrawals and alter administrative controls.
The attacker targeted three core vaults: the JLP Delta Neutral, SOL Super Staking and BTC Super Staking vaults. The largest single transfer involved approximately 41.7 million JLP tokens, valued at roughly $155 million at the time of the theft. Additional assets stolen included USDC, SOL, cbBTC, wBTC, liquid staking tokens and other assets.
According to DefiLlama, Drift’s total value locked (TVL) collapsed from approximately $550 million to under $250 million following the attack. This makes it the largest DeFi hack of 2026 to date and the second-largest security incident in the Solana ecosystem after the $326 million Wormhole bridge exploit in 2022.
The Drift team confirmed the exploit on X, stating that Drift Protocol was experiencing an “active attack” and that deposits and withdrawals had been suspended. The team added that it is coordinating with multiple security firms, cross-chain bridges and exchanges to contain the incident.
Tracing the stolen funds
On-chain data shows that the attacker’s wallet was created approximately eight days before the exploit and received a small test transfer from a Drift vault during that period, suggesting a premeditated and carefully staged operation.
After draining the vaults, the attacker mostly used a Solana-based DEX aggregator to rapidly swap the stolen tokens into USDC. These funds were then bridged to the Ethereum blockchain, where the attacker swapped to ETH.
Elliptic Investigator, with its holistic cross-chain tracing capabilities, can be used to follow the flow of funds from the initial exploit on Solana through to the attacker’s current holdings on Ethereum.
Source: Elliptic Investigator
Elliptic’s intelligence team will continue monitoring the movement of the stolen funds and will update this post as new information becomes available.
How Elliptic can help
Elliptic has taken urgent action to ensure that addresses associated with this exploit are available to screen and trace using our holistic blockchain analytics solutions. Customers will be able to ensure that they do not inadvertently process funds originating from, or being sent to, the entity or individuals responsible for this theft.
Because the attacker drained more than 15 types of tokens across multiple vaults, tracking the full scope of this exploit on Solana requires an understanding of how the network organizes on-chain activity. Solana’s architecture creates separate token accounts for each asset type held by a single entity, meaning the attacker’s JLP, USDC, SOL, cbBTC and other stolen assets each sit in distinct on-chain addresses. Analytics providers that treat these addresses as unrelated will see fragments of the attacker’s activity, not the complete picture.
Elliptic’s Advanced Clustering for Solana automatically links main accounts with all associated token accounts, providing complete entity visibility regardless of which address is screened. When you screen any address controlled by the attacker, Elliptic identifies all related addresses and returns risk intelligence for the complete entity. This is critical for an exploit of this nature, where the stolen funds span numerous asset types and the attacker is actively dispersing them across wallets and blockchains.
Combined with our industry-leading blockchain coverage surpassing 65 blockchains, these capabilities ensure that the laundering techniques currently being observed, from Solana through to Ethereum and beyond, remain fully traceable. Any associated risks or exposure to virtual asset services can therefore be detected in near-real time.
If you would like to learn how Elliptic can help your organization screen for exposure to this and other high-profile exploits, contact our team today.
