Drift Protocol, the largest decentralized perpetual futures exchange on Solana, experienced a major security incident on April 1, 2026, with Elliptic calculating $286 million in stolen assets and identifying on-chain behavior consistent with previous DPRK-attributed operations. According to DefiLlama, Drift's total value locked collapsed from approximately $550 million to under $250 million following the attack, making it the largest DeFi hack of 2026 and second-largest in Solana's history after the $326 million Wormhole bridge exploit. On-chain data shows the attacker's wallet was created eight days before the exploit and received test transfers from Drift vaults, suggesting premeditated planning, before using Solana-based DEX aggregators to rapidly swap stolen tokens into USDC. If confirmed, this would represent the eighteenth DPRK act Elliptic has tracked this year with over $300 million stolen, continuing the DPRK's sustained campaign linked by the US government to weapons program funding, with DPRK actors believed to have stolen over $6.5 billion in recent years.