$285 Million Drift Hack Traced to Six-Month DPRK Social Engineering Operation

A cluster of high-impact incidents and active campaigns was reported in early April 2026. Solana DEX Drift suffered a $285M theft traced to a six-month DPRK social‑engineering operation that abused durable nonces to seize protocol admin powers. North Korean actors (UNC1069) were also attributed to a targeted social‑engineering compromise of the Axios npm maintainer and related npm supply‑chain abuse; researchers additionally found 36 malicious npm packages masquerading as Strapi plugins that exploit Redis/PostgreSQL, deploy reverse shells and persistent implants. Multiple high‑severity/vulner�