Drift Protocol said a North Korean state-affiliated group infiltrated its ecosystem for six months before a $285 million exploit drained the Solana-based DEX. Drift attributed the attack to UNC4736 with medium-high confidence and said the group first posed as a quantitative trading firm at a crypto conference last fall. The attackers later onboarded an Ecosystem Vault, deposited more than $1 million of their own capital, and then erased chats and malware traces after the exploit. Drift said onchain fund flows and overlapping personas support the attribution, while Mandiant has not yet confirmed it pending forensics.