Drift Loses $285 Million in Durable Nonce Social Engineering Attack Linked to DPRK

Drift, a Solana-based decentralized exchange, lost $285 million in a sophisticated attack using durable nonces and social engineering, with evidence linking it to North Korean threat actors.

• •Attackers used durable nonce accounts to pre-sign transactions weeks in advance, bypassing Drift's Security Council multisig controls without exploiting a smart contract bug.
• •A fictitious asset (CarbonVote Token) was created with minimal liquidity, and Drift's oracles mistakenly treated it as collateral worth hundreds of millions of dollars.
• •Elliptic and TRM Labs identified laundering patterns consistent with DPRK actors, including Tornado Cash usage, cross-chain bridging, and speed of post-hack fund movement.
• •If confirmed, this would be Elliptic's eighteenth tracked DPRK crypto theft in 2026, with DPRK-linked actors estimated to have stolen over $6.5 billion in recent years.