A Multi-Act Scam
The decentralized trading protocol Drift has just unveiled chilling investigation results: the $280 million theft that hit it in 2024 wasn’t a simple hack, but the culmination of a meticulously orchestrated social engineering campaign spanning six months.
For those discovering the term: social engineering is the art of manipulating humans rather than computer systems. Imagine a burglar who, instead of forcing a lock, calls you impersonating a friend until you hand over the keys yourself.
The North Korean Fingerprint
Drift and the SEAL 911 investigation team designate with “medium-high” confidence the same actors responsible for the Radiant Capital hack as orchestrators of this operation. While absolute certainty remains elusive in this field, the convergence points between the two incidents are numerous enough to support this conclusion.
These cybercriminal groups based in North Korea have progressively built an unenviable reputation in the crypto ecosystem. Their operations stand out for remarkable patience and growing sophistication, combining social tactics and technical exploits.
Patience and Precision
The duration of this campaign—six months of preparation—illustrates a shift in attackers’ strategy. Gone are the days of chaotic flash raids: in with targeted, methodical, almost… professional operations. North Korean hackers cultivate their access like gardening, waiting for the optimal moment.
This approach raises questions about the current resilience of DeFi protocols. Even with seasoned security teams, the human factor remains the weakest link.
Perspective
These revelations remind us that blockchain security extends beyond cryptography. In an ecosystem where stakes reach hundreds of millions, attackers sharpen their tactics. The industry must advance on two fronts simultaneously: technological and human. Without this dual approach, scammers—whether operating from hidden servers or via well-organized phone calls—will continue to thrive.