2026 Drift Protocol — ~$270M Solana vault drain (DPRK long-con; multisig; Apr 1)

Drift Protocol, a decentralized perpetual futures exchange on Solana, was hit by a large exploit on April 1, 2026 in which attackers drained on the order of roughly $270–285 million in crypto from protocol-associated vaults within a very short window (figures vary slightly by outlet). Subsequent disclosures characterized a multi-month operation: threat actors allegedly posed as a quantitative trading firm, engaged contributors from late 2025, onboarded ecosystem vault integrations, deposited substantial capital, and met team members at conferences before obtaining signing capacity needed to execute withdrawals—vectors discussed publicly included malicious TestFlight-distributed software and developer-workstation compromise tied to editor/tooling issues, with Solana durable nonce / pre-signed transaction mechanics cited in analyses. Open-source reporting attributed activity to North Korean state-affiliated clusters (e.g., UNC4736 / AppleJeus / Citrine Sleet) and described rapid bridging/swapping of stolen assets. This is an on-chain protocol treasury loss and operator-compromise story, not a classic consumer PII database breach with a countable “records affected” row metric.