On April 1, 2026, attackers drained $285 million from Drift Protocol — the largest decentralized perpetual futures exchange on Solana — in approximately 12 minutes. The exploit, attributed with moderate-to-high confidence to North Korean state-sponsored group UNC4736 (also known as AppleJeus or C...
"Circle is a regulated company that complies with sanctions, law enforcement orders, and court-mandated requirements. We freeze assets when legally required, consistent with the rule of law and with strong protections for user rights and privacy." — Circle spokesperson, statement to CoinDesk, April 3, 2026
On April 1, 2026, attackers drained $285 million from Drift Protocol — the largest decentralized perpetual futures exchange on Solana — in approximately 12 minutes. The exploit, attributed with moderate-to-high confidence to North Korean state-sponsored group UNC4736 (also known as AppleJeus or Citrine Sleet) by TRM Labs and Elliptic, represents the largest DeFi hack of 2026 and the second-largest in Solana's history behind the $326 million Wormhole bridge exploit of 2022.
The attack did not rely on a smart contract vulnerability. Instead, it combined six months of social engineering against multisig signers, abuse of Solana's "durable nonce" transaction feature, a fabricated token used to manipulate oracle price feeds, and a governance migration that eliminated the protocol's last defensive timelock. Drift's total value locked collapsed from $550 million to under $250 million. The DRIFT governance token fell 42%. SOL dropped 4.5%. A dozen downstream protocols paused operations. As of April 6, no funds have been recovered, and the Q1 2026 recovery rate for DeFi exploits stands at 0.04%.
At approximately 14:00 UTC on April 1, 2026, an attacker submitted pre-signed transactions to Solana mainnet that transferred administrative control of Drift Protocol's core vaults. Two transactions, four slots apart on the Solana blockchain, were sufficient to create and approve a malicious admin transfer, then approve and execute it. Full control of Drift's protocol-level permissions changed hands in under two minutes.
The attacker then executed 31 rapid withdrawals across Drift's vaults, draining USDC, JLP, SOL, and other tokens. Total extracted value: $285.3 million, according to Elliptic's on-chain analysis. The operation — from first transaction to last withdrawal — lasted approximately 12 minutes.
Before the exploit, Drift held approximately $550 million in TVL and represented 8.6% of Solana's total $6.4 billion DeFi TVL. Within one hour, the protocol's TVL collapsed to under $250 million. Drift's core vault fell from $309 million to $41 million.
Drift suspended deposits and withdrawals within minutes of detection, according to CoinDesk's reporting on the initial response.
Standard Solana transactions expire after approximately 90 seconds if not included in a block. Durable nonces override this mechanism. They replace the expiring blockhash with a fixed nonce — a one-time code stored in a dedicated on-chain account — that keeps a transaction valid indefinitely until submitted. Once a signer approves a durable nonce transaction, that approval cannot be revoked unless the nonce account is manually advanced, a step most users do not monitor.
According to CoinDesk's technical analysis, this feature — designed for convenience in offline signing and scheduled transactions — became the attack's primary enabler. Between March 23 and March 30, the attacker created multiple durable nonce accounts. Two were linked to Drift Security Council multisig members. Two were controlled by the attacker directly.
On March 23, the attacker obtained pre-signed approvals from at least two of five Security Council members through social engineering. The signers believed they were approving routine administrative transactions. The durable nonce mechanism preserved these approvals indefinitely, giving the attacker a loaded weapon with no expiration date.
On March 27, Drift executed a planned Security Council migration, swapping a council member and moving to a 2-of-5 threshold configuration with zero timelock. This migration — unrelated to the attack — eliminated the delay window that might have allowed detection and intervention. By March 30, a new durable nonce account appeared tied to a member of the updated multisig, indicating the attacker had re-obtained the required 2-of-5 threshold under the new configuration, according to BlockSec's incident analysis.
According to TRM Labs' investigation, on-chain staging began on March 11, but the broader operation started approximately six months earlier. The attacker posed as representatives of a trading firm, meeting Drift contributors in person across multiple countries. This extended social engineering campaign built trust relationships that were later exploited to obtain multisig pre-signatures.
TRM assessed the operation as consistent with tactics used in the October 2024 Radiant Capital attack, tracked by Mandiant as UNC4736. In that case, attackers also used months of social engineering before executing a coordinated governance takeover.
The sophistication of the Drift operation — combining in-person meetings, fabricated corporate identities, phishing of signing requests, and patient on-chain staging — represents an escalation over previous DeFi exploits that relied primarily on code vulnerabilities or flash loan attacks.
The attacker created a token called "CarbonVote Token" (CVT), minting approximately 750 million units. A liquidity pool was seeded on Raydium with approximately $500 in initial liquidity. Wash trading over several weeks established an artificial price history near $1. Drift's oracles picked up this fabricated price data and treated CVT as legitimate collateral worth hundreds of millions of dollars.
Using this inflated collateral position, the attacker was able to borrow and withdraw real assets — USDC, JLP, SOL — against what was effectively a phantom asset. The 31 withdrawal transactions executed during the 12-minute window all drew against this fraudulently valued collateral.
The oracle manipulation highlights a persistent structural weakness in DeFi: automated price feeds can be gamed when thin liquidity allows attackers to establish arbitrary price histories for newly created assets without human review or minimum liquidity thresholds.
TRM Labs stated with "moderate to high confidence" that the operation was carried out by the same threat actors responsible for the October 2024 Radiant Capital attack, tracked by Mandiant as UNC4736. The group is also known as AppleJeus (by Kaspersky) and Citrine Sleet (by Microsoft) and is affiliated with the North Korean state.
Elliptic independently flagged the exploit as consistent with previous DPRK-backed operations based on laundering patterns and on-chain timestamps. According to Elliptic's blog post, this represents the 18th suspected state-sponsored attack targeting DeFi infrastructure in 2026.
Post-exploit fund movement followed established DPRK laundering playbooks: rapid consolidation into high-liquidity stablecoins, cross-chain bridging to Ethereum, and distribution across dozens of wallets to complicate tracing. The bulk of the stolen assets were converted to USDC and SOL before being bridged.
After the exploit, the attacker bridged approximately $232 million in USDC from Solana to Ethereum via Circle's Cross-Chain Transfer Protocol (CCTP) over six consecutive hours during U.S. business hours, according to blockchain investigator ZachXBT. The transfers were spread across more than 100 transactions.
ZachXBT publicly criticized Circle for failing to freeze or blacklist the wallets during this window. He released data suggesting that Circle has declined to freeze approximately $420 million in suspicious USDC transactions spanning 15 distinct incidents dating back to 2022.
Circle responded that it "freezes assets when legally required, consistent with the rule of law." The company noted that it acts on sanctions compliance, law enforcement orders, and court-mandated requirements — not unilateral community requests.
The controversy exposed a structural tension in stablecoin infrastructure: Circle's CCTP facilitated the largest single movement of stolen funds in 2026, yet the issuer maintained it had no legal obligation to intervene absent a court order. Days earlier, Circle had frozen USDC balances in a separate civil case, prompting critics to describe the enforcement posture as "arbitrary and unpredictable," per CoinDesk's reporting.
PYMNTS.com noted that the incident raises questions about whether regulated stablecoin issuers should bear a duty to monitor and block suspicious high-volume flows through their own bridging infrastructure, particularly when the community has flagged the funds as stolen within minutes of the exploit.
The immediate aftermath sent Solana DeFi into defensive posture. SOL dropped approximately 4.5% within 24 hours while the broader crypto market remained mostly flat, according to CoinMarketCap.
A dozen protocols with exposure to Drift liquidity or strategies paused operations or assessed losses:
The DRIFT governance token fell 42.18%, dropping to $0.03998. Drift's share of Solana DeFi TVL — previously 8.6% — contracted sharply, and the gap has not been filled by competing protocols as of April 6.
DailyCoin reported that the exploit triggered a broader "risk-off" posture across Solana DeFi, with net TVL outflows across the ecosystem in the days following the attack, as users withdrew funds from protocols perceived to share similar governance structures.
The Drift exploit dominated Q1 2026 security statistics. According to ainvest.com's aggregation, total confirmed DeFi losses in Q1 2026 reached $501 million across 145 incidents. Drift accounted for 57% of that total.
DefiLlama's narrower methodology counted $169 million in losses across 34 protocol-level compromises, excluding the Drift exploit from certain categories due to its governance-attack classification.
Other significant Q1 incidents included:
| Incident | Date | Amount | Method | |----------|------|--------|--------| | Step Finance | January 2026 | $40M | Private key compromise | | Truebit | January 8, 2026 | $26.4M | Smart contract manipulation | | Resolv Labs | March 21, 2026 | Undisclosed | Private key attack |
The Q1 recovery rate of 0.04% — effectively zero — represents a deterioration from previous quarters and underscores the near-total impunity for well-resourced attackers, particularly state-sponsored groups with established laundering infrastructure.
The Drift exploit represents a maturation of DeFi attack methodology. The vulnerability was not in Solana's code, Drift's smart contracts, or any cryptographic primitive. It was in the human layer: multisig signers who trusted what they were signing, a governance migration that removed a critical timelock, and an oracle system that accepted fabricated price data at face value.
The six-month preparation timeline, in-person social engineering across multiple countries, and patient on-chain staging — all attributed to a North Korean state-sponsored group — suggest that DeFi protocols holding hundreds of millions in TVL now face threat actors with nation-state resources and operational discipline.
The structural questions raised by the exploit remain unresolved. Solana's durable nonce feature has no built-in revocation mechanism. DeFi governance structures continue to rely on small multisig committees without mandatory timelocks. Oracle systems still accept thinly traded assets as collateral. And stablecoin issuers maintain they have no obligation to freeze funds absent a court order, even when bridging infrastructure is used to launder stolen assets in real time.
As of April 6, no reimbursement plan has been announced. The funds remain unrecovered. The 0.04% Q1 recovery rate suggests they will stay that way.