According to Cyvers Alerts, the $280 million theft from Drift Protocol was a long-term social engineering attack launched by North Korean (DPRK) hackers, rather than a contract vulnerability. The attackers set up persistent random number accounts and compromised signers starting from March 23. Ultimately, on April 1, within just a few minutes, they exploited a critical weakness in the project’s 2/5 multi-signature setup without a time lock to gain admin access and remove withdrawal restrictions. Currently, Drift has attempted to negotiate through on-chain messages. The ripple effect of this incident has impacted more than 20 Solana protocols.