Over the weekend, the team behind Drift, a Solana-based crypto protocol for perpetual futures trading, provided a comprehensive update on the massive April 1 hack that drained $285 million. The incident has been attributed to a sophisticated six-month intelligence operation run by North Korean state-sponsored hackers group UNC4736. The attack began in fall 2025 with attackers posing as a quantitative trading firm, building relationships through in-person meetings at major crypto conferences across multiple countries. The breach involved compromised devices through malicious TestFlight apps and VSCode vulnerabilities, ultimately leading to the largest crypto exploit of 2026. Some observers are criticizing the Drift team for security lapses, including allowing unvetted apps on hardware tied to multi-signature access and lack of strict compartmentalization between development environments and signing keys.