North Korea Spent Six Months Inside Drift Before $270M Heist

Nation-state hackers just showed DeFi what patient capital actually looks like.

The Summary

North Korean hackers spent six months infiltrating Drift Protocol, posing as traders, meeting contributors in person across multiple countries, and depositing $1 million of their own capital before draining $285 million in 12 minutes
Drift and SEAL 911 assess with "medium-high confidence" the same actors hit Radiant Capital for $58 million in October 2024
Solana Foundation responded with 24/7 threat monitoring for protocols holding over $10 million and a dedicated incident response network
Most stolen funds were bridged to Ethereum within hours, per blockchain analytics firms tracking the attack

The Signal

This wasn't a bug bounty hunter who got greedy. The attackers posed as a legitimate trading firm, conducted in-person meetings with Drift contributors across multiple countries, and deposited $1 million of their own capital into the protocol. They traded. They waited. For six months. Then on April 1, they emptied Drift's vaults in roughly 12 minutes, draining more than a dozen asset types from Solana's largest decentralized perpetual futures exchange.

The timeline matters. CoinTelegraph reports this required "months of deliberate preparation." That's not hacking in the traditional sense. That's intelligence work. The same methodology, the same patience, the same willingness to invest upfront that SEAL 911 and Drift linked to the Radiant Capital breach. Elliptic and TRM Labs both flagged North Korean signatures in the transaction patterns.

This changes the threat model for every DeFi protocol. You're not just defending against anonymous hackers probing for smart contract bugs. You're defending against state-sponsored operators who will fly to your city, shake your hand, build rapport, deposit real money, and wait until you trust them. Traditional security audits don't catch that. Bug bounties don't catch that. Code reviews don't catch that.

The Solana Foundation's response is telling: 24/7 threat monitoring for protocols with over $10 million in total value locked, plus a coordinated incident response network. That's infrastructure-level security thinking, not protocol-level. It acknowledges that when you're managing hundreds of millions in tokenized assets, you're playing in the same threat environment as traditional finance, except your attack surface is public, your transactions are irreversible, and your adversaries have nuclear programs to fund.

The Implication

If you're building in DeFi or managing a protocol with meaningful TVL, your security posture just got more expensive. Social engineering defenses, operational security, background checks on trading partners, these aren't nice-to-haves anymore. The $285 million Drift paid is tuition for the entire ecosystem. Watch for insurance protocols to reprice risk and venture capital to start asking harder questions about security budgets during diligence. The era of "code is law" just collided with the era of "some attackers have six-month runways and diplomatic passports."