Drift Protocol confirmed a massive crypto hack after attackers drained about $280 million on April 1, 2026, following a sophisticated six-month infiltration campaign using fake identities, malware links, and conference access. The decentralized exchange revealed that attackers approached contributors around October 2025 at major crypto conferences, posing as a quantitative trading firm seeking integration while building relationships through repeated in-person meetings. The breach involved malware deployment through shared tools and links, with security researchers flagging vulnerabilities in developer tools between December 2025 and February 2026 that attackers exploited. Investigators found overlaps with the October 2024 Radiant Capital exploit, with on-chain fund movements and operational patterns matching earlier activity attributed to North Korea-aligned groups, forcing teams to reassess contributor verification, device security, and access controls.