Drift Protocol, the largest decentralized perpetual futures exchange on the Solana blockchain, experienced a major security incident on April 1, 2026. Elliptic calculated that the combined value of assets stolen in this exploit was $286 million.
The on-chain behavior, laundering methodologies and network-level indicators associated with the attack are consistent with techniques observed in previous DPRK-attributed operations. If confirmed, this incident would represent the eighteenth DPRK act Elliptic has tracked this year, with over $300 million stolen so far. It is a continuation of the DPRK's sustained campaign of large-scale cryptoasset theft, which the US government has linked to the funding of its weapons programs.
According to DefiLlama, Drift's total value locked (TVL) collapsed from approximately $550 million to under $250 million following the attack. This makes it the largest DeFi hack of 2026 to date and the second-largest security incident in the Solana ecosystem after the $326 million Wormhole bridge exploit in 2022.
