Drift Protocol confirms April 1st attack planned by North Korean hacker group

Drift Protocol stated on X platform that preliminary investigations indicate that the attack on April 1, 2026 was planned by the North Korean government backed hacker group UNC4736. The organization has been interacting with Drift contributors for six months and inducing the download of malicious code repositories or applications through participating in crypto conferences, establishing fake quantitative trading companies, and other means since the fall of 2025. At present, Drift has frozen the protocol function and removed the damaged wallet. Mandiant has been invited to participate in the investigation, confirming that the flow of funds on the chain can be traced back to the Radiant Capital attacker in October 2024.