Drift linked its April 1 exploit to a six-month social engineering campaign by suspected North Korean actors after about $280 million was drained from the Solana-based perpetuals exchange. Drift said the relationship began around fall 2025, when people posing as a quant trading firm approached contributors at a major crypto conference. Drift said the group later onboarded an Ecosystem Vault and deposited more than $1 million of its own capital. Drift said the exploit used durable nonces rather than a smart contract bug, while Mandiant has not formally attributed the attack because device forensics are still pending.