Drift has revealed that the April 1, 2026, attack that led to the theft of $285 million was the culmination of a months-long targeted and meticulously planned social engineering operation undertaken by the Democratic People’s Republic of Korea (DPRK) that began in the fall of 2025.
The Solana-based decentralized exchange described it as “an attack six months in the making,” attributing it with medium confidence to a North Korean state-sponsored hacking group dubbed UNC4736, which is also tracked under the cyptonyms AppleJeus, Citrine Sleet, Golden Chollima, and Gleaming Pisces.
The threat actor has a history of targeting the cryptocurrency sector for financial theft since at least 2018. It’s best known for the X_TRADER/3CX supply chain breach in 2023 and the $53 million hack of decentralized finance (DeFi) platform Radiant Capital in October 2024.
“The basis for this connection is both on-chain (fund flows used to stage and test this operation trace back to the Radiant attackers) and operational (personas deployed across this campaign have identifiable overlaps with known DPRK-linked activity),” Drift said in a Sunday analysis.
In an assessment published in late January 2026, cybersecurity company CrowdStrike described Golden Chollima as an offshoot of Labyrinth Chollima that’s primarily geared towards cryptocurrency theft by targeting small fintech firms in the U.S., Canada, South Korea, India, and Western Europe.
“The adversary typically conducts smaller-value thefts at a more consistent operational tempo, suggesting responsibility for ensuring baseline revenue generation for the DPRK regime,” CrowdStrike said. “Despite improving trade relations with Russia, the DPRK requires additional revenue to fund ambitious military plans that include constructing new destroyers, building nuclear-powered submarines, and launching additional reconnaissance satellites.”
In at least one incident observed in late 2024, UNC4736 delivered malicious Python packages through a fraudulent recruitment scheme to a European fintech company. Upon gaining access, the threat actor moved laterally to the victim’s cloud environment to access IAM configurations and associated cloud resources, and ultimately diverted cryptocurrency assets to adversary-controlled wallets.
How the Drift Attack Likely Unfolded
Drift, which is working with law enforcement and forensic partners to piece together the sequence of events that led to the hack, said it was the target of a “structured intelligence operation” that required months of planning.
Starting in or about fall 2025, individuals posing as a quantitative trading company approached Drift contributors at a major cryptocurrency conference and international crypto conferences under the pretext of integrating the protocol. It has since emerged that this was a deliberate approach, where members of this trading group approached and built rapport with specific Drift contributors at various major industry conferences that took place in several countries over a period of six months.
“The individuals who appeared in person were not North Korean nationals,” Drift explained. “DPRK threat actors operating at this level are known to deploy third-party intermediaries to conduct face-to-face relationship-building.”
“They were technically fluent, had verifiable professional backgrounds, and were familiar with how Drift operated. A Telegram group was established upon the first meeting, and what followed were months of substantive conversations around trading strategies and potential vault integrations. These interactions are typical of how trading firms interact and onboard with Drift.”
Then, sometime between December 2025 and January 2026, the group onboarded an Ecosystem Vault on Drift, a step that required filling out a form with strategy details. As part of this process, the individuals are said to have engaged with multiple contributors, asking them “detailed and informed product questions,” while depositing more than $1 million of their own funds.
This, Drift said, was a calculated move designed to build a functioning operational presence inside the Drift ecosystem, with integration conversations continuing with the contributors through February and March 2026. This included sharing links for projects, tools, and applications that the company claimed to be developing.
The possibility that these interactions with the trading group may have acted as the initial infection pathway assumed significance in the wake of the April 1 hack. But as Drift revealed, their Telegram chats and malicious software had been deleted right around the time the attack took place.
It’s suspected that there may be two primary attack vectors –
- One contributor may have been compromised after cloning a code repository shared by the group as part of efforts to deploy a frontend for their vault.
- A second contributor was persuaded into downloading a wallet product via Apple’s TestFlight to beta test the app.
The repository-based intrusion vector is assessed to have involved a malicious Microsoft Visual Studio Code (VS Code) project that weaponizes the “tasks.json” file to automatically trigger the execution of malicious code upon the project in the IDE by using the “runOn: folderOpen” option.
It’s worth noting that this technique has been adopted by North Korean threat actors associated with the Contagious Interview campaign since December 2025, prompting Microsoft to introduce new security controls in VS Code versions 1.109 and 1.110 to prevent unintended execution of tasks when opening a workspace.
“The investigation has shown so far that the profiles used in this third-party targeted operation had fully constructed identities including employment histories, public-facing credentials, and professional networks,” Drift said. “The people Drift contributors met in person appeared to have spent months building profiles, both personal and professional, that could withstand scrutiny during a business or counterparty relationship.”
North Korea’s Fragmented Malware Ecosystem
The disclosure comes as DomainTools Investigations (DTI) disclosed that DPRK’s cyber apparatus has evolved into a “deliberately fragmented” malware ecosystem that’s mission-driven, operationally resilient, and resistant to attribution efforts. This shift is believed to be a response to law enforcement actions and intelligence disclosures about North Korean hacking campaigns.
“Malware development and operations are increasingly compartmentalized, both technically and organizationally, ensuring that exposure in one mission area does not cascade across the entire program,” DTI said. “Crucially, this model also maximizes ambiguity. By separating tooling, infrastructure, and operational patterns along mission lines, the DPRK complicates attribution and slows defender decision-making.”
To that end, DomainTools noted that DPRK’s espionage-oriented malware track is chiefly associated with Kimsuky, while Lazarus Group spearheads efforts to generate illicit revenue for the regime, transforming into a “central pillar” for sanctions evasion. The third track revolves around deploying ransomware and wiper malware for purposes of strategic signaling and drawing attention to its capabilities. This disruptive branch is associated with Andariel.
Social Engineering Behind Contagious Interview and IT Worker Fraud
Social engineering and deception continue to be the main catalyst for many of the intrusions that have been attributed to DPRK threat actors. This includes the recent supply chain compromise of the hugely popular npm package, Axios, as well as ongoing campaigns like Contagious Interview and IT worker fraud.
Contagious Interview is the moniker assigned to a long-running threat in which the adversary approaches prospective targets and tricks them into executing malicious code from a fake repository as part of an assessment. Some of these efforts have used weaponized Node.js projects hosted on GitHub to deploy a JavaScript backdoor called DEV#POPPER RAT and an information stealer known as OmniStealer.
On the other hand, DPRK IT worker fraud refers to coordinated efforts by North Korean operatives to land remote freelance and full-time roles at Western companies using stolen identities, AI-generated personas, and falsified credentials. Once hired, they generate steady revenue and leverage the access to introduce malware and siphon proprietary and sensitive information. In some cases, the stolen data is used to extort money from businesses.
The state-sponsored program deploys thousands of technically skilled workers in countries like China and Russia, who connect to company-issued laptops hosted at laptop farms in the U.S. and elsewhere. The scheme also relies on a network of facilitators to receive work laptops, manage payroll, and handle logistics. These facilitators are recruited through shell companies.
The process starts with recruiters who identify and screen potential candidates. Once accepted, the IT workers enter an onboarding phase, where facilitators assign identities and profiles, and guide them through resume updates, interview preparation, and initial job applications. The threat actors also work with collaborators to complete hiring requirements for full-time opportunities where strict identity verification policies are enforced.
As noted by Chainalysis, cryptocurrency plays a central role in funneling a majority of the wages generated by these IT worker schemes back to North Korea while evading international sanctions.
“The cycle is constant and unending. North Korean IT workers understand that, sooner or later, they will either quit or be dismissed from any given role,” Flare and IBM X-Force said in a report last month. “As a result, they are continually shifting between jobs, identities, and accounts – never remaining in one position or using a single persona for very long.”
New evidence unearthed by Flare has since revealed the campaign’s efforts to actively recruit individuals from Iran, Syria, Lebanon, and Saudi Arabia, with at least two Iranians receiving formal offer letters from U.S. employers. There have been more than 10 instances of Iranian nationals being recruited by the regime.
Facilitators have also been found to use LinkedIn to hire separate people from Iran, Ireland, and India, who are then coached to land the jobs. These individuals, called callers or interviewers, get on the phone with American hiring managers, pass technical interviews, and impersonate the real or fake Western personas curated by them. When a caller fails an interview, the facilitator reviews the recording and provides feedback.
“North Koreans are deliberately targeting U.S. defense contractors, cryptocurrency exchanges, and financial institutions,” Flare said. “While the primary motivations appear to be financial, the deliberate targeting evidenced from their documents indicates that there may be other objectives at play as well.”
“The DPRK is not simply deploying its own nationals under false identities. It is building a multinational recruitment pipeline, drawing skilled developers from Iran, Syria, Lebanon, and Saudi Arabia into an infrastructure designed to infiltrate U.S. defense contractors, cryptocurrency exchanges, financial institutions, and enterprises of every size. The recruits are real software engineers, paid in cryptocurrency, coached through interviews, and slotted into fabricated Western personas.”
