Drift, a Solana-based DeFi platform, lost roughly $280–285 million on April 1, 2026, in a highly targeted operation. Elliptic and TRM Labs attributed this operation with medium-to-high confidence to North Korean state-backed group UNC4736 (aka AppleJeus/Golden Chollima, linked to Lazarus). Investigators say the heist was at least six (6) months in the making and relied on deep social engineering rather than smart contract bugs. Starting in fall 2025, operatives posing as a quantitative trading firm approached specific Drift contributors at multiple international crypto conferences, building trust with technically fluent, well documented personas. They maintained months of “normal” business discussions over Telegram, onboarded an Ecosystem Vault, and even deposited over $1 million to establish a credible operational presence inside the Drift ecosystem. Drift believes two (2) contributors were ultimately compromised: one likely via a malicious code repository containing a booby-trapped VS Code project (abusing tasks.json to auto execute code on folder open), and another via a TestFlight “wallet” app. With this access, attackers obtained or misrepresented transaction approvals and, on April 1, rapidly hijacked the project’s Security Council powers, removed withdrawal limits, and drained user funds in about twelve (12) minutes using pre-signed transactions. Elliptic, TRM Labs, and others say on chain behavior, laundering patterns, and infrastructure match prior DPRK crypto thefts, making this one (1) of at least eighteen (18) North Korean-linked crypto operations in 2026 and part of a broader, revenue driven campaign to fund the regime.