Key Takeaways

  • State-sponsored operatives impersonated a legitimate trading company, cultivating trust within Drift Protocol for half a year before executing a $270 million theft on April 1.
  • The perpetrators established in-person relationships with Drift team members at industry conferences spanning several nations and injected over $1 million in genuine funds.
  • System infiltration occurred through a malicious TestFlight application and exploitation of a documented VSCode/Cursor security flaw.
  • The operation bears the signature of UNC4736, alternatively identified as AppleJeus or Citrine Sleet, with connections to North Korea.
  • Legal experts suggest the breach could represent civil negligence, with class action litigation advertisements already emerging.

Drift Protocol suffered a $270 million security breach on April 1 following approximately six months of methodical infiltration by a state-sponsored hacking collective.

The initial encounter occurred at a prominent cryptocurrency conference during fall 2025. The adversaries presented themselves as representatives of a quantitative trading operation, arriving with sophisticated technical knowledge, authenticated professional credentials, and comprehensive understanding of Drift’s infrastructure.

A Telegram channel was established, initiating months of sustained communication. Discussions centered on typical concerns for trading firms engaging with DeFi platforms: vault integration specifications, algorithmic trading approaches, and operational logistics.

During the December 2025 through January 2026 period, the group completed formal onboarding procedures for an Ecosystem Vault within Drift. They conducted numerous collaborative sessions with platform contributors and transferred more than $1 million of actual capital to establish credibility.

Drift personnel encountered members of the organization in face-to-face meetings at industry events across multiple jurisdictions throughout February and March 2026. When April 1 arrived, the professional relationship had matured over nearly six months.

Technical Compromise Methodology

The infiltration utilized dual attack vectors. Initially, a contributor downloaded a TestFlight application — Apple’s pre-release distribution system, which circumvents standard App Store security validation — that the operatives marketed as their proprietary wallet solution.

Additionally, the attackers leveraged a documented security weakness in VSCode and Cursor, two prevalent code editing platforms. The simple act of opening a file within either application was sufficient to execute malicious code silently on the target machine, providing no indication to the user.

After gaining access to compromised systems, the adversaries collected necessary credentials to secure two multisig authorizations. These pre-authorized transactions remained inactive for over a week before execution on April 1, extracting $270 million in less than sixty seconds.

Security researchers attribute the operation to UNC4736, also monitored under aliases AppleJeus or Citrine Sleet. Blockchain transaction patterns connected back to the Radiant Capital compromise from October 2024, which authorities also linked to North Korea. The individuals who appeared physically at conferences were reportedly non-North Korean nationals — DPRK-affiliated groups frequently employ third-party proxies operating under fabricated identities.

Cryptocurrency attorney Ariel Givner indicated the incident could constitute civil negligence. She noted that fundamental security protocols — including maintaining signing keys on isolated, air-gapped systems and conducting thorough background verification on developers encountered at industry events — appeared absent.

“Every serious project knows this. Drift didn’t follow it,” Givner stated. Marketing materials for class action lawsuits targeting Drift have already begun appearing.

Drift stated it possesses “medium-high confidence” that identical actors executed the October 2024 Radiant Capital breach, where malicious software was distributed through Telegram by someone impersonating a former contractor.