North Korean group UNC4736 drains $270M from Drift after six-month operation

UNC4736 drained $270M from Drift after a six‑month infiltration. Drift calls it the largest native Solana dApp exploit to date.

North Korea–linked UNC4736 posed as a quant firm. They embedded in the ecosystem, then executed on April 1, 2026.

- First contact in fall 2025 at a major crypto conference, per Drift’s incident update referenced by industry participants here and here.
- The group onboarded an Ecosystem Vault in Dec 2025–Jan 2026 and deposited over $1M.
- Contributors met them in person across several countries through Feb–Mar 2026. Intermediaries used fully built professional identities.
- Two intrusion vectors. A malicious TestFlight “wallet” app. And a known VSCode and Cursor auto‑execution flaw flagged since late 2025.
- After device compromise, attackers captured two multisig approvals. They pre‑signed Solana durable nonce transactions that sat for over a week.
- On April 1, the transactions executed in under 60 seconds. $270M left protocol vaults, including 41.72M JLP later swapped via Jupiter, Raydium, Orca, and Meteora, then bridged to Ethereum.
- Drift attributes the hack to UNC4736 (aka Citrine Sleet, AppleJeus). On‑chain flows link to wallets from the Oct 2024 Radiant Capital exploit, with operational overlap noted by Mandiant and SEALS 911 cited in discussion.
- Drift characterizes the operation as intelligence‑driven. They state standard DeFi checklists and smart contract audits are insufficient against such timelines per the shared update.

Largest Solana dApp exploit on record. Recovery efforts and a full Mandiant forensic report are pending.