Elliptic stated Thursday the $285 million Drift Protocol exploit, the biggest this yr, carries “a number of indicators” of North Korea’s state-sponsored DPRK hacker group involvement.
The analysis agency pointed particularly to onchain habits, laundering methodologies and network-level indicators, all of which align with earlier state-linked assaults.
Drift Protocol, whose token has dropped over 40% to roughly $0.06 because the hack, is the biggest decentralized perpetual futures trade on the Solana blockchain.
“If confirmed, this incident would characterize the eighteenth DPRK act Elliptic has tracked this yr, with over $300 million stolen up to now,” the report stated.
“It’s a continuation of the DPRK’s sustained marketing campaign of large-scale cryptoasset theft, which the U.S. authorities has linked to the funding of its weapons applications. DPRK-linked actors are believed to be liable for billions of {dollars} in cryptoasset theft in recent times,” Elliptic added.
Hours earlier, Arkham information confirmed that over $250 million had been moved from Drift to an interim pockets, then to varied different addresses.
In December, a Chainalysis report revealed DPRK hackers stole a file $2 billion of crypto in 2025, together with the $1.4 billion Bybit breach, representing a 51% enhance from the earlier yr. The U.S. Treasury Division final month stated North Korea makes use of the stolen belongings to fund the nation’s weapons of mass destruction program.
Fairly than specializing in the exploit itself, Elliptic’s evaluation highlights a well-known operational sample. The exercise seems “premeditated and punctiliously staged,” with early check transactions and pre-positioned wallets previous the primary occasion.
The report explains that after executed, funds have been quickly consolidated and swapped, bridged throughout chains, and transformed into extra liquid belongings, reflecting a structured, repeatable laundering move designed to obscure origin whereas sustaining management.
A central problem, Elliptic notes, is Solana’s account mannequin. As a result of every asset is held in a separate token account, exercise tied to a single actor can seem fragmented throughout a number of addresses. With out linking these, investigators danger seeing “fragments of the attacker’s exercise, not the whole image.”
That is the place Elliptic’s report highlights the clustering method, which connects token accounts again to a single entity, permitting publicity to be recognized no matter which handle is screened. In an incident involving greater than a dozen asset varieties, that entity-level view turns into vital.
The case additionally emphasizes, Elliptic provides in its report, how laundering has develop into inherently cross-chain. Funds moved from Solana to Ethereum and past, demonstrating the necessity for what Elliptic described as “holistic cross-chain tracing capabilities.”