Drift Traces $295 Million Stolen in April Hack

Drift Foundation is tracking about $295 million taken from users in the April 1 hack of Drift Protocol. The foundation has frozen roughly $9.2 million of the stolen funds and is working with security firms and law enforcement to recover more.

Any recovered assets will go to the DFX recovery pool, whether they are secured through freezes, a bounty program or law enforcement action.

The exploit removed about half of Drift Protocol’s total value locked. The foundation hired Mandiant, zeroShadow and SEAL 911 to investigate the attack, track the funds and support recovery efforts.

Mandiant identified the attacker as UNC6862, a North Korean threat group. Earlier analyses by security firms attributed the attack to UNC4736, another North Korean-linked group.

zeroShadow tracked the stolen assets and shared its findings with law enforcement. The firm also monitored laundering activity that began in July.

The latest investigation found that about 130,259 ETH was bridged to Ethereum through four wallets. Three wallets held a combined 107,165 ETH that had not moved. The fourth transferred about 23,094 ETH to Tornado Cash on July 23.

The foundation is working with zeroShadow and law enforcement to track and flag withdrawals linked to the stolen funds. Returning frozen assets may take time because the funds moved across several blockchains and jurisdictions.

About $9.2 million was frozen after the attacker moved the assets through Tornado Cash in August. The recovery process involves law enforcement and remains ongoing.

Security experts described the attack as different from a typical smart contract exploit. Their analysis indicated that it involved a long-term combination of corporate espionage and on-chain manipulation rather than a single code vulnerability.