Film Infiltration
How North Korean hackers deceived
#DRIFT for months to execute the $280 million theft
Social Engineering and the "Long Game" of the DPRK
#DriftProtocol has revealed details of an attack that redefines the concept of "risk in DeFi". What appeared to be a technical hack turned out to be a structured intelligence operation lasting six months.
Face-to-Face Deception: The attackers did not operate from the shadows. They posed as a legitimate quantitative trading company, attending international conferences and meeting in person with the Drift team for months. They created trust bonds, Telegram groups, and even deposited $1 million of their own capital to seem like genuine partners.
Digital Trojan Horses: The intrusion was achieved through two vectors of social engineering
Malicious repositories: They exploited a vulnerability in editors like VS Code that executed hidden code when opening files.
Beta Apps: They induced a collaborator to install a fake wallet via Apple’s TestFlight.
The Connection to North Korea: Drift and the SEAL 911 security team link the attack to the UNC4736 group (AppleJeus), the cyber arm of North Korean intelligence. The funds used for the preparation were traced back to the hack of Radiant Capital in 2024.
“Durable Nonce” Attack: The hack was not a failure in smart contracts. The attackers used a legitimate function of
#solana to pre-sign transactions and, after gaining administrative access via previously installed malware, drained the protocol in minutes.
Security experts like tanuki42_ rate this attack as the most elaborate in cryptocurrency history. The fact that they used physical "facilitators" (non-Koreans) to overcome due diligence sets a dangerous precedent for any development team in the sector.
#CryptoNews #HackerAlert $DRIFT