Drift, whose crypto project was recently hacked by North Korea, has published a partial but fascinating article on how the attack began...
(As a reminder, digital coins worth approximately $280 million were stolen in the attack.)

According to Drift's report, this was a highly calculated and sophisticated attack that lasted over a long period.

The attackers began the attack as early as last year, when at a crypto conference held in 2025, the attackers physically approached some of Drift's core developers under the guise of a trading company interested in interfacing with the Drift protocol.

The attackers continued to meet physically with those key project figures on several occasions, at various crypto conferences and in different countries around the world, while strengthening their connections with them.

According to Drift, the attackers were professional, super technical, with a proven professional history, demonstrating proficiency in understanding how the Drift protocol works.

Immediately after the first meeting, they set up a shared Telegram group, where they discussed with Drift how the connection between their trading company and the protocol would be executed, including technical aspects, etc., in conversations that lasted several months.

The connection continued during February-March 2026, including physical meetings, collaborations, and more.

On 1.4.26, when the attack was executed and the millions were stolen, the Telegram group was disabled and all communication with that "trading company" disappeared.

According to Drift, there were three vectors through which the attackers entered:

1. Malicious code in a repo that was transferred to the Drift team, and one of Drift's developers cloned it.

2. A Wallet app that one of Drift's developers was asked to download via Test Flight to test the product of the "trading company."

3. A vulnerability in Vscode and Cursor that allows the execution of malicious code simply by opening a file or project...