Drift Protocol Attributes Exploit to North Korea, Taps Helium and Gauntlet Veterans for Relaunch

Drift Protocol announced that cybersecurity firm Mandiant conclusively attributed its recent security breach to UNC6862, a North Korean state-sponsored threat group ¹. According to an official update published on June 4, 2026, the attacker's operational telemetry, tactics, and techniques matched historical operations run by state-backed actors linked to similar decentralized finance intrusions ¹.

To prepare for its upcoming platform relaunch on Solana, the team hired former Helium Head of Protocol Engineering Noah Prince to serve as its Head of Protocol ¹. Prince, who previously managed Helium's network migration to Solana, will lead efforts to restructure the codebase and reinforce platform defenses ¹. Additionally, Drift engaged former members of the Gauntlet team to overhaul risk management and vault mechanics, covering liquidator optimization, liquidation engines, funding rates, and post-launch risk monitoring ¹.

Relaunch Strategy and User Recovery

The protocol stated that its primary goal is deploying a secure, revenue-generating platform to fund a dedicated user recovery pool designed to repay outstanding customer losses ¹. Drift plans to position itself as the primary perpetual exchange denominated in $USDT on Solana, backed by a strategic support package from Tether and additional partners ¹.

The initiative follows previously outlined remediation steps, including token claims and asset redemption efforts and earlier frameworks for a $147.5M recovery plan after the protocol was compromised ¹. Drift said it will disclose further specifics regarding the relaunch schedule and recovery mechanics in subsequent updates ¹.