Drift Protocol, the largest decentralized futures exchange on the Solana network, suffered a massive security breach on April 1, 2026.
Attackers drained an estimated $286 million in various digital assets. Blockchain security firm Elliptic strongly suspects that hackers linked to the Democratic People’s Republic of Korea (DPRK) are behind the attack.
This conclusion stems from specific on-chain behaviors and laundering methods that closely match previous North Korean cyber operations.
How The Breach Unfolded
The attack happened quickly, draining most of Drift Protocol’s available funds within a single hour. Security experts at PeckShield believe the hackers managed to steal the protocol’s private keys for its administrator.
This critical compromise gave the attackers the necessary privileges to approve unauthorized withdrawals and to alter system controls.
The attackers focused their efforts on three main storage areas: the JLP Delta Neutral, SOL Super Staking, and BTC Super Staking vaults.
The biggest single theft was a massive transfer of 41.7 million JLP tokens, worth about $155 million at the time. The hackers also swept up a mix of other cryptocurrencies, including USDC, SOL, and wrapped Bitcoin.
As a result of this massive theft, Drift Protocol’s total value locked (TVL) plummeted from $550 million to less than $250 million.
This makes it the largest decentralized finance (DeFi) hack of 2026 so far. It also ranks as the second-largest hack in Solana’s history, trailing only the $326 million Wormhole bridge attack in 2022.
Blockchain records show that the attacker carefully planned this heist. The hacker created their digital wallet about eight days before the main attack and even received a small test transfer from Drift during that time.
Once they drained the main vaults, the attacker worked quickly to hide the money. They used a Solana-based exchange service to swap the stolen tokens into USDC quickly.
According to Elliptic research, the hackers moved these funds across blockchain networks, bridging them from Solana to Ethereum.
Once on the Ethereum network, they swapped the assets into ETH. Tracking these movements is notoriously complicated because of how Solana organizes data.
The network creates separate accounts for each type of token a user holds, meaning the stolen assets sit scattered across many different addresses.
Security firms are actively using advanced tracking tools to connect these separate token accounts back to the main attacker.
By clustering all these addresses into a single entity, investigators can follow the complete money trail as it jumps across different blockchains.
Analysts continue to monitor the stolen funds in real time, helping crypto exchanges and platforms block the attackers from cashing out the $286 million.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
