Wu said that according to Cyvers Alerts, the $280 million theft from Drift Protocol was a long-term social engineering attack launched by North Korean (DPRK) hackers, rather than a contract vulnerability. The attackers set up persistent random number accounts and compromised signers starting from March 23, ultimately exploiting a critical weakness in the project’s 2/5 multi-signature and no time lock on April 1 within just a few minutes to gain administrator privileges and remove withdrawal restrictions. Currently, Drift has attempted to negotiate through on-chain messages. The chain reaction caused by this incident has affected more than 20 Solana protocols.