North Korean Hackers Drain $285 Million From Drift in Seconds
Basically, North Korean hackers stole $285 million from a finance platform in just 10 seconds.
In a shocking incident, North Korean hackers drained $285 million from the Drift platform in just 10 seconds. This sophisticated attack highlights serious vulnerabilities in DeFi protocols. Drift is now working with security firms to recover the stolen assets.
What Happened
A North Korean threat actor has been linked to a staggering $285 million heist from the decentralized finance (DeFi) platform Drift. This attack, described by Drift as a highly sophisticated operation, involved meticulous planning and execution. The attackers set up their infrastructure about eight days prior to the heist, preparing multiple nonce-based transactions and ultimately taking control of an admin key.
Who's Affected
The primary victim of this attack is Drift, a DeFi platform that facilitates trading and liquidity for various cryptocurrencies. This incident not only affects Drift but also raises concerns for its users and the broader cryptocurrency community, given the scale of the theft.
What Data Was Exposed
While specific user data exposure details remain unclear, the attack led to the theft of $286 million in various cryptocurrencies. The hackers executed the heist by draining funds from five vaults, which included popular tokens such as USDC and wETH.
How It Works
The attack was executed with extreme precision. The hackers utilized a durable nonce on the Solana blockchain, allowing them to create transactions that would not expire. They pre-signed transactions to ensure rapid execution. Just five hours before the heist, they gained control of a Drift admin key, which was initially protected by a multisig but could be modified with just two out of five approvals.
Tactics & Techniques
The attackers created a fake collateral market for a worthless token, CVT, just seconds before the heist. This market was designed to maximize fund drainage by manipulating the token's parameters and disabling Drift's safety systems. The entire operation was executed in less than 10 seconds, showcasing the hackers' ability to exploit vulnerabilities in the DeFi protocol.
Defensive Measures
In response to this incident, Drift is collaborating with multiple security firms and law enforcement to trace and freeze the stolen assets. Users are advised to remain vigilant and monitor their accounts for any suspicious activity. The incident underscores the need for enhanced security measures in DeFi platforms to prevent such sophisticated attacks in the future.