Drift: Hackers Suspected to Be a North Korea Organization, Disguised and Infiltrated Over Six Months

Drift released the latest investigation into the attack, indicating that the operation was carried out by the same threat actors responsible for the October 2024 Radiant Capital hacking incident, with on-chain fund flows and operational techniques closely matching. Mandiant attributed the Radiant Capital hack to UNC4736, an organization linked to the North Korean government. Additionally, this attack was a carefully planned operation that lasted six months. Starting in fall 2025, a group posing as a "quantitative trading firm" actively approached Drift contributors at multiple international crypto conferences.