Drift, a decentralized exchange built on the Solana blockchain, has reached out directly to the wallets believed to be holding approximately $285 million in crypto stolen from its platform earlier this week. On Friday, the team announced via X that it had sent on-chain messages to four wallets on Ethereum‘s network, stating simply: “We are ready to speak.” The messages indicated that critical information about the parties behind the exploit had already been identified. Drift added that further updates would be shared once third-party attribution efforts were completed.
Blockchain security firm Elliptic has begun linking the attack to hackers associated with the Democratic People’s Republic of Korea, citing the attackers’ on-chain behavior and laundering methods as key indicators. North Korea-linked actors have reportedly taken approximately $6.5 billion in crypto assets in recent years, according to Elliptic. Some other security researchers have suggested the perpetrators may have possessed a degree of insider knowledge. The true identity of those responsible has not yet been officially confirmed.
Drift disclosed earlier this week that the exploit stemmed from what it described as sophisticated social engineering, through which attackers gained administrative control of the platform by accessing two private keys. The breach has had ripple effects across Solana’s broader ecosystem, affecting multiple projects that had built dependencies on the exchange. The scale of the incident makes it one of the largest exploits in decentralized finance so far this year.
On-chain negotiations following major crypto thefts are not uncommon in the decentralized finance space, though their outcomes vary widely. In a notable past case, an individual who stole $600 million from Poly Network claimed to have done so for entertainment and ultimately returned the funds following an extended dialogue. In many other instances, attackers disregard outreach entirely and ignore any accompanying legal threats.
Michael Egorov, founder of decentralized exchange Curve Finance, told Decrypt that the likelihood of fund recovery is essentially zero if North Korean state-sponsored hackers are responsible. He noted that such actors neither cooperate with affected projects nor fear law enforcement. However, he said the situation changes significantly if the attackers turn out to be independent actors whose identities are exposed, estimating that the probability of fund return in that scenario rises to nearly 100 percent.
Egorov also noted that so-called maximal extractable value traders represent a particular exception. These traders use strategies that involve positioning ahead of other users’ transactions to capture profitable trades, and they occasionally intercept funds that hackers are attempting to move. When that occurs, he said, they tend to return the funds more often than not, sometimes retaining a portion as a bounty or leaving the decision to the affected project.
The public nature of on-chain communication also attracted an unrelated participant. An individual controlling a wallet holding roughly $200 worth of Ethereum sent an unsolicited message to Drift’s wallet on Friday, suggesting the attackers could send them $10 million in exchange for interfering with Drift’s recovery efforts. Whether Drift intends to offer a formal bounty to the attackers remains unclear, and the exchange had not responded to a request for comment at the time of publication.
Originally reported by Decrypt.
