<figure class="wp-block-image size-large"><img width="325px" height="183px" srcSet="https://d2ly46a6b1u3g6.cloudfront.net/wp-content/uploads/2026/04/02200036/9973-375x212.webp 375w, https://d2ly46a6b1u3g6.cloudfront.net/wp-content/uploads/2026/04/02200036/9973-662x374.webp 662w, https://d2ly46a6b1u3g6.cloudfront.net/wp-content/uploads/2026/04/02200036/9973.webp 686w" sizes="(max-width: 425px) 150px, 450px" src="https://ll-blog-dev.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2026/04/02200036/9973-662x374.webp" alt="" class="wp-image-9994"/></figure>


Drift Protocol faces potential legal liability for negligence. A North Korea-aligned hacking group exploited poor security practices. They stole $280 million from the Solana-based DeFi platform. Attorney <a href="https://x.com/GivnerAriel/status/2040807239259128209" target="_blank" rel="noopener">Ariel Givner</a> argues the team failed to follow basic operational security standards. That may constitute a breach of their duty to protect user funds. Class action lawsuit advertisements are already circulating.
The attackers spent six months building trust with Drift&#x27;s team. They executed the exploit only after that trust was established. This comes from the platform&#x27;s official post-mortem report. The social engineering campaign began at a major crypto conference in October 2025. The hackers posed as potential integration partners. Over the following months, they delivered malware through Telegram. It compromised developer machines. That gave them access to critical infrastructure.
Givner&#x27;s negligence claim centers on multiple security failures. &quot;The team failed to store critical signing keys on isolated, air-gapped machines, mixed developer activity with key infrastructure, and did insufficient due diligence on developers met at conferences,&quot; she said. The attorney criticized Drift for maintaining prolonged Telegram conversations with unknown parties. They opened unvetted code repositories. They installed untrusted applications on devices connected to multisignature wallet controls. North Korean state-sponsored hacking operations are well-documented. The risks are known.
Drift Protocol suspects the same threat actors executed the October 2024 Radiant Capital hack. That one also used Telegram-delivered malware and North Korean impersonation tactics. &quot;With medium-high confidence, the same actors were behind the October 2024 Radiant Capital hack,&quot; the post-mortem states. That pattern of long-term infiltration and social engineering represents an evolving threat model. Traditional security measures often fail to address it.
The incident highlights how sophisticated social engineering campaigns have become. They&#x27;re now primary attack vectors against DeFi platforms. Technical exploits of smart contract code? That&#x27;s not the issue here. These human-focused operations bypass even robust cryptographic protections. Teams just need to fail at maintaining strict operational security protocols.
The case may establish new legal precedents. Courts will need to evaluate security standards in decentralized finance. Negligence claims might succeed. DeFi protocols could face heightened expectations around vetting collaborators. They&#x27;d need to segregate development environments from production infrastructure. Air-gapped key storage would become mandatory. The industry&#x27;s built on trustless technology. The Drift hack underscores an uncomfortable reality. Human vulnerabilities remain the weakest link.

Apple Removes Jack Dorsey's Bitchat from China Store

National Bank of Rwanda Warns Against Bybit's Rwandan Franc Crypto Trades

North Korean Hackers Steal $285 Million in Major Drift Protocol Exploit

Darknet Fraud Kit Targets Crypto Identity Verification

<figure class="wp-block-image size-large"><img width="325px" height="183px" srcset="https://d2ly46a6b1u3g6.cloudfront.net/wp-content/uploads/2026/04/02200036/9973-375x212.webp 375w, https://d2ly46a6b1u3g6.cloudfront.net/wp-content/uploads/2026/04/02200036/9973-662x374.webp 662w, https://d2ly46a6b1u3g6.cloudfront.net/wp-content/uploads/2026/04/02200036/9973.webp 686w" sizes="(max-width: 425px) 150px, 450px" src="https://ll-blog-dev.s3.ap-southeast-2.amazonaws.com/wp-content/uploads/2026/04/02200036/9973-662x374.webp" alt="" class="wp-image-9994" /></figure>


Drift Protocol faces potential legal liability for negligence. A North Korea-aligned hacking group exploited poor security practices. They stole $280 million from the Solana-based DeFi platform. Attorney <a href="https://x.com/GivnerAriel/status/2040807239259128209" target="_blank" rel="noopener">Ariel Givner</a> argues the team failed to follow basic operational security standards. That may constitute a breach of their duty to protect user funds. Class action lawsuit advertisements are already circulating.
The attackers spent six months building trust with Drift's team. They executed the exploit only after that trust was established. This comes from the platform's official post-mortem report. The social engineering campaign began at a major crypto conference in October 2025. The hackers posed as potential integration partners. Over the following months, they delivered malware through Telegram. It compromised developer machines. That gave them access to critical infrastructure.
Givner's negligence claim centers on multiple security failures. "The team failed to store critical signing keys on isolated, air-gapped machines, mixed developer activity with key infrastructure, and did insufficient due diligence on developers met at conferences," she said. The attorney criticized Drift for maintaining prolonged Telegram conversations with unknown parties. They opened unvetted code repositories. They installed untrusted applications on devices connected to multisignature wallet controls. North Korean state-sponsored hacking operations are well-documented. The risks are known.
Drift Protocol suspects the same threat actors executed the October 2024 Radiant Capital hack. That one also used Telegram-delivered malware and North Korean impersonation tactics. "With medium-high confidence, the same actors were behind the October 2024 Radiant Capital hack," the post-mortem states. That pattern of long-term infiltration and social engineering represents an evolving threat model. Traditional security measures often fail to address it.
The incident highlights how sophisticated social engineering campaigns have become. They're now primary attack vectors against DeFi platforms. Technical exploits of smart contract code? That's not the issue here. These human-focused operations bypass even robust cryptographic protections. Teams just need to fail at maintaining strict operational security protocols.
The case may establish new legal precedents. Courts will need to evaluate security standards in decentralized finance. Negligence claims might succeed. DeFi protocols could face heightened expectations around vetting collaborators. They'd need to segregate development environments from production infrastructure. Air-gapped key storage would become mandatory. The industry's built on trustless technology. The Drift hack underscores an uncomfortable reality. Human vulnerabilities remain the weakest link.

Drift Protocol Exploit Highlights Systemic Legal Risks in Decentralized Finance

Drift Protocol faces legal action after North Korean hackers stole $280M exploiting poor security. Attorney claims negligence in protecting user funds.