Blockchain analytics firm Elliptic reported that the Drift Protocol exploit shows strong indicators of involvement by actors linked to the Democratic People’s Republic of Korea (DPRK). The attacker targeted three main vaults — JLP Delta Neutral, SOL Super Staking, and BTC Super Staking — using a wallet created just eight days before the incident, with prior test transactions suggesting premeditation.

After the attack, stolen assets were converted into USDC and bridged from Solana to Ethereum. The laundering patterns, including cross-chain transfers and structured movement of funds, closely match techniques observed in previous DPRK-attributed operations.