Drift Protocol Says April 1 Attack Tied to North Korea-Backed UNC4736

Drift Protocol said on X that its initial findings suggest the April 1, 2026 attack was orchestrated by UNC4736, a North Korean government-backed hacking group. The project said the group spent roughly six months engaging Drift contributors starting in autumn 2025, attending crypto conferences and setting up fake quantitative trading firms to lure targets into downloading malicious code libraries or applications. Drift has frozen protocol functions and removed the compromised wallets. The team has brought in Mandiant to support the investigation; Mandiant confirmed the on-chain fund flows can be traced to the same actors behind the Radiant Capital exploit in October 2024.