'This is not an April Fool's joke': Crypto platform Drift suspends services after millions stolen

Date:
Thu, 02 Apr 2026 12:25:00 +0000

Description:
So far, no one has claimed responsibility for the attack in which $280
million were pulled from Drift.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Tech Radar Pro Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Become a Member in Seconds Unlock instant access to exclusive member features. Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over. You are
now subscribed Your newsletter sign-up was successful Join the club Get full access to premium articles, exclusive features and a growing list of member rewards. Explore An account already exists for this email address, please log in. Subscribe to our newsletter Drift Protocol confirms $280 million crypto theft via sophisticated attack abusing durable nonces Hackers hijacked Security Council powers through misrepresented transaction approvals and social engineering Deposits in borrow/lend, vaults, and trading affected; incident marks largest crypto heist of 2026 so far Decentralized cryptocurrency exchange Drift has confirmed suffering a cyberattack in which threat actors stole hundreds of millions of dollars worth of tokens.

On April 1 2026,, Drift Protocol posted on X, saying it was experiencing an active attack, and that all deposits and withdrawals were suspended as a result. This is not an April Fools joke, the maintainers tweeted. We are coordinating with multiple security firms, bridges, and exchanges to contain the incident. Article continues below You may like Historic LastPass breach enabling cryptocurrency theft, investigation reveals North Korean hackers use AI-generated video to deliver malware for macOS and Windows This dangerous North Korean malware has now split into three entities for maximum impact Highly sophisticated attack Soon after, an update was posted, explaining that a malicious actor was able to access the protocol through a novel attack involving durable nonces, resulting in a rapid takeover of Drifts Security Council administrative powers.

Security Council is a governance and safety mechanism designed to act quickly in emergencies, without waiting for full DAO voting. It is a small, trusted group (usually multisig signers) within the protocols governance structure, who have limited, fast-track powers. Ironically enough, Security Council was supposed to prevent attacks like this one.

Drift says the attack was a highly sophisticated operation that appears to have involved multi-week preparation and staged execution.

It was not a bug, and no seed phrases were compromised. Instead, the attack involved unauthorized or misrepresented transaction approvals obtained prior to execution, likely facilitated through durable nonce mechanisms and sophisticated social engineering. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news
and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

At press time, no one claimed responsibility for this attack, but Drift said roughly $280 million was withdrawn from the protocol. North Korean state-sponsored groups Lazarus and different Chollima variants (Labyrinth, Pressure, Golden) are usually tasked with stealing cryptocurrencies from organizations in the west. The country uses the stolen money to fund its government apparatus and its weapons programme, some researchers claim.

All deposits placed into borrow/lend, vault deposits, and funds deposited for trading, are affected, Drift confirmed. This is now one of the largest crypto heists ever, and the largest one this year so far.

Via The Record The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!

And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.



======================================================================
Link to news story: https://www.techradar.com/pro/security/this-is-not-an-april-fools-joke-crypto- platform-drift-suspends-services-after-millions-stolen


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)