Drift Signals Negotiation with North Korea-Linked Hackers After $285M Exploit
By John Nada·Apr 3, 2026·8 min read
Drift seeks to negotiate with hackers linked to North Korea after a $285 million exploit, highlighting vulnerabilities in the DeFi sector and potential recovery challenges.
Drift, a Solana-based decentralized exchange, has reached out for negotiations with hackers believed to be linked to North Korea following a significant $285 million exploit. The attack has raised questions about the recovery of stolen funds, especially since state-sponsored groups are notorious for not cooperating with attempts to recover assets. Michael Egorov, founder of Curve Finance, stated that if North Korean hackers are indeed involved, the chances of recovering the stolen funds are effectively zero.
The on-chain messages sent by Drift's team targeted four wallets holding substantial amounts of the stolen crypto, signaling a willingness to engage with the attackers. Historically, there have been instances where outreach has led to the return of stolen funds, such as the Poly Network incident where a hacker returned $600 million after negotiations. However, the success of such attempts often hinges on the attackers’ identity and motivations.
Egorov noted that if the funds were taken by a state-sponsored group, cooperation is unlikely. Yet, if the perpetrators are not affiliated with the state, there may be a higher likelihood of recovery. Drift's communication strategy reflects a broader trend in decentralized finance (DeFi), where on-chain negotiations have become a response to significant thefts. The incident highlights vulnerabilities in DeFi protocols, particularly those that provide administrative controls susceptible to social engineering attacks.
The exploit that affected Drift was reportedly facilitated by access to two private keys, indicating a sophisticated level of planning and execution by the attackers. Security firm Elliptic has pointed to on-chain behaviors that suggest North Korean involvement, but other experts caution that insider knowledge may also have played a role. This incident not only impacts Drift but also has ramifications for the broader Solana ecosystem, which relies on decentralized exchanges for functionality.
Drift's attempts to communicate with the hackers could be seen as a desperate but necessary move for the DeFi sector, where the stakes are incredibly high. As the platform works to navigate this crisis, the community awaits updates on the identity of the attackers and the potential for fund recovery. The response from the crypto community has been mixed, with some individuals even mocking the situation on-chain, as seen in a message from a wallet holder suggesting a multimillion-dollar payout to the attackers.
This situation underscores the ongoing challenges faced by decentralized finance projects in securing their assets against sophisticated attacks. The financial system's vulnerability to cyber crime remains a pressing concern, as evidenced by North Korea's history of crypto thefts, totaling approximately $6.5 billion in recent years. The implications of such exploits extend beyond the immediate parties involved, affecting investor confidence and regulatory scrutiny across the DeFi landscape.
Drift's incident is a reminder of the necessity for enhanced security measures within the DeFi space. As the community rallies to support affected projects, the larger narrative of risk management and security will continue to evolve. The outcome of Drift’s negotiation attempt and the subsequent actions taken will likely set precedents for how similar situations are handled in the future, shaping the security landscape of decentralized finance for years to come.
The team behind Drift signaled on Friday that it wants to negotiate with hackers linked to North Korea. If the funds were actually stolen by a state-sponsored group, the odds of recovery are zero, according to Curve Finance founder Michael Egorov. The on-chain messages sent by Drift’s team provoked a response from a seemingly random wallet holding $200 worth of Ethereum. Finding the group or individuals that stole $285 million worth of crypto from Drift earlier this week may be a tough task in the real world, but the team behind the Solana-based decentralized exchange knew exactly where to find its attackers on-chain.
On Friday, Drift said in a post on X that it had sent messages on Ethereum’s network to four wallets holding massive amounts of stolen crypto, which several security experts have begun linking to the Democratic People’s Republic of Korea: “We are ready to speak.” The so-called Hermit Kingdom isn’t exactly known for negotiating with projects that its elite hackers siphon funds from, considering that bad actors linked to North Korea have absconded with $6.5 billion worth of crypto in recent years, according to blockchain security firm Elliptic. Critical information of parties related to the exploit have been identified, as Drift is now sending an on-chain message from 0x0934faC45f2883dd5906d09aCfFdb5D18aAdC105 to the ETH wallets that hold the stolen funds.
Drift’s communication reflects an understanding of the high stakes involved. In a world where millions of dollars can vanish in an instant, the ability to track and trace transactions is both a boon and a curse. While on-chain transactions provide transparency, they also enable attackers to be identified and, in some cases, engaged. This duality highlights the complexity of the DeFi landscape, where the boundaries between criminality and negotiation can sometimes blur.
Still, the messages indicated that the true identity of whomever facilitated one of the biggest exploits in decentralized finance so far this year may not be truly known yet. That’s because the messages focused on the discovery details associated with attackers’ identities. “Critical information of parties related to the exploit have been identified,” the on-chain messages sent by Drift’s team read. “To the community, Drift will share further updates as soon as third-party attributions are completed.”
When millions of dollars in crypto get swiped from a DeFi project, on-chain negotiations are a common course of action. Sometimes they work. Several years ago, someone who stole $600 million from Poly Network “for fun” returned the funds after a lengthy dialogue, for example. Oftentimes, attackers ignore any outreach and associated legal threats. The probability of seeing Drift’s funds returned if North Korean hackers are involved is zero, according to Michael Egorov, founder of decentralized exchange Curve Finance. “They never cooperate and they are not afraid of law enforcement,” he told Decrypt.
However, if the funds weren’t swiped by a state-sponsored group, then there is a chance that they'll be returned, he said. If the attackers’ identities are revealed, then he said that the “probability of them returning funds jumps to almost 100%.” Egorov noted that “maximal extractable value” traders can be an exception to the rule. With a strategy that focuses on essentially front-running users’ transitions to make profitable trades, they can occasionally step in front of hackers trying to abscond with funds. “When they do, they return funds more often than not,” he said, adding that they sometimes hold onto some as a bounty, or leave it up for projects to determine.
Drift signaled earlier this week that the exploit, which has affected projects throughout Solana’s ecosystem that had built dependencies on the decentralized exchange, stemmed from “sophisticated social engineering.” The attackers were able to gain administrative control over the platform’s security by accessing two private keys. This highlights a concerning trend in the DeFi space, where social engineering tactics are becoming increasingly effective against even well-structured platforms. Elliptic pointed to the attackers’ on-chain behavior and laundering methodologies as factors that led them to believe that hackers linked to North Korea were involved. Still, other security experts suggested that the attackers may have had some degree of insider knowledge.
It’s unclear who Drift believes the hackers could be, as well as whether the decentralized exchange is willing to offer them a bounty. Nonetheless, its attempt to retrieve funds on behalf of itself and the DEX’s users are public for all to see. This transparency could serve as a deterrent for future attacks or, conversely, inspire more sophisticated attempts if attackers see that they can negotiate.
Someone controlling a wallet that holds $200 worth of Ethereum couldn’t resist the opportunity to chime in on Friday. In an on-chain message to Drift’s wallet, the individual wagered that the attackers could “send me $10 million to mess with the Drift team.” This light-hearted comment stands in contrast to the serious nature of the underlying situation, illustrating the diverse reactions within the crypto community. While some users are deeply concerned about the implications of such a significant exploit, others seem to find humor in the chaos, reflecting the often unpredictable nature of online interactions in decentralized finance.
As the situation evolves, it will undoubtedly affect how DeFi projects approach security and recovery strategies in the future. With the caliber of attacks increasing, the need for robust security protocols and contingency plans has never been more critical. Each incident serves as a learning opportunity for the entire industry, as participants seek to navigate a landscape fraught with risk while striving for innovation and growth.