Blockchain security firm Elliptic has identified North Korean state-sponsored hackers as the likely perpetrators behind the $270 million exploit of Drift Protocol, a decentralized trading platform on the Solana blockchain. The attack represents one of the largest crypto thefts of 2026 and highlights the persistent threat posed by nation-state actors.

According to Drift’s investigation, the attackers executed a sophisticated six-month intelligence operation. They posed as representatives of a legitimate trading firm, met Drift contributors in person across multiple countries, and deposited $1 million of their own capital to establish credibility before executing the exploit.

“This was not an opportunistic hack,” said a Drift spokesperson. “The level of planning and patience demonstrated suggests a highly organized operation with significant resources behind it.”

The stolen funds were primarily in USDC, Circle’s dollar-pegged stablecoin. Circle has faced criticism for allegedly failing to freeze the stolen assets quickly enough, though the company maintains it followed all appropriate protocols.

The incident has reignited debates about security in decentralized finance (DeFi) protocols. Ledger’s Chief Technology Officer Charles Guillemet warned that artificial intelligence is making such attacks cheaper and faster to execute, forcing the industry to rethink security approaches.

International law enforcement agencies are coordinating efforts to track and recover the stolen funds, though success remains uncertain. North Korean hacking groups have been linked to numerous high-profile crypto thefts, with proceeds reportedly funding the regime’s weapons programs.