According to Wu Shuo, as disclosed by Cyvers Alerts, the $280 million theft from Drift Protocol was a long-term social engineering attack initiated by North Korean (DPRK) hackers, rather than a contract vulnerability. The attackers set up persistent random number accounts starting on March 23 and compromised the signers. Ultimately, on April 1, within just a few minutes, they exploited a critical weakness in the project’s 2/5 multi-signature setup without a time lock to gain admin access and remove withdrawal restrictions. Currently, Drift has attempted to negotiate through on-chain messages. The ripple effects of this incident have impacted more than 20 Solana protocols.