North Korean Hackers Drain $285 Million From Drift DeFi Platform in 10 Seconds

Key Points

• Attack stole $285-286 million from Drift DeFi platform in just 10 seconds
• North Korean threat actors used pre-positioned infrastructure set up 8 days prior
• Hackers created fake collateral market using worthless CVT token minted 20 days earlier
• Safety system was disabled 25 seconds before the heist using compromised admin key
• Funds were immediately laundered through multiple wallets after extraction

Full Details

According to blockchain security firm Elliptic, North Korean threat actors executed one of the most precise DeFi heists to date, draining $285-286 million from Drift protocol in a mere 10 seconds. The attackers pre-positioned infrastructure approximately eight days before the heist, prepared multiple nonce-based transactions, and gained admin control of the platform. Twenty seconds before the attack, they used the compromised admin key to create a fake collateral market for CVT, a worthless token they had minted 20 days earlier. This allowed them to disable Drift's safety system designed to prevent massive, rapid asset drains. The hackers then drained funds from five vaults within seconds and immediately began laundering the proceeds through multiple wallets. This attack represents one of the largest cryptocurrency thefts in recent years and demonstrates the increasing sophistication of state-sponsored cybercriminal groups targeting DeFi platforms.