Adversary Intelligence — 2026-04-09

Six-Month DPRK Intelligence Operation Behind $285 Million Drift Protocol Cryptocurrency Theft Detailed

Forensic analysis revealed a six-month DPRK state-sponsored intelligence operation behind the April 1 theft of $285 million from Drift Protocol, the largest Solana DeFi exploit in history. The operation, attributed to UNC4736 (AppleJeus/Citrine Sleet/Golden Chollima), used third-party intermediaries to approach Drift contributors at crypto conferences, build constructed professional identities, and deposit over $1 million to establish credibility. Attack vectors included weaponized VS Code projects and a fake Apple TestFlight wallet application. Fund flows and operational personas link the operation to the October 2024 Radiant Capital breach.

Analysis
The six-month preparation phase, constructed identities, and in-person conference approaches mark an escalation in DPRK tradecraft sophistication beyond previous crypto heists. UNC4736 is now investing operational resources comparable to traditional HUMINT recruitment cycles. The $285 million take likely exceeds North Korea's annual conventional arms export revenue, reinforcing cryptocurrency theft as a strategic funding stream.
2 sources
  1. Crypto Project Details Alleged 6-Month North Korean Intel Op Behind $285 Million Hack - Gizmodo
  2. Drift links $280 million exploit to six-month social engineering op run by suspected North Korean actors - The Block

View in full brief →

UNCLASSIFIED // OPEN SOURCE