---
title: "Drift Protocol Attributes Exploit to North Korea, Taps Helium and Gauntlet Veterans for Relaunch"
description: "A forensic review by Mandiant tied the breach to threat group UNC6862 as the decentralized exchange prepares a rebooted USDT perpetual platform on Solana."
url: https://basisdesk.news/news/drift-protocol-mandiant-north-korea-exploit-relaunch
published: 2026-10-21T10:21:17.809Z
modified: 2026-10-21T10:21:17.809Z
section: Security & Hacks
author: Basis Desk Newsroom (AI-generated, source-verified)
sentiment: neutral
tickers: [USDT]
tags: [drift-protocol, solana, mandiant, cybersecurity, decentralized-exchange]
license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice.
---

# Drift Protocol Attributes Exploit to North Korea, Taps Helium and Gauntlet Veterans for Relaunch

A forensic review by Mandiant tied the breach to threat group UNC6862 as the decentralized exchange prepares a rebooted USDT perpetual platform on Solana.

## At a glance

- **What happened:** Drift Protocol attributed its exploit to North Korean group UNC6862 via a Mandiant investigation and hired Noah Prince as Head of Protocol ahead of a platform relaunch.
- **Why it matters:** Platform trading fees from the relaunched USDT perpetual exchange will directly fund a dedicated pool to reimburse affected user losses.
- **Who is affected:** Drift Protocol users with outstanding losses, Solana ecosystem traders, and platform risk managers.
- **What's next:** Drift Protocol will release operational details, timing, and mechanics for the official relaunch and the user recovery pool.
- **Status:** announced
- **Primary source:** [Drift Recovery Update – June 3, 2026 | Drift Updates](https://www.drift.trade/updates/drift-recovery-update-june-3-2026) — drift.trade

## Key points

- Mandiant's forensic analysis attributed the Drift exploit to UNC6862, a North Korean state-sponsored threat group.
- Drift hired former Helium executive Noah Prince as Head of Protocol and engaged former Gauntlet members for risk modeling.
- The rebooted perpetual exchange will focus on USDT pairs to generate revenue for a dedicated user loss recovery pool.

## Editorial remark

- **Context:** Drift suffered a major exploit earlier in 2026, prompting partner intervention—including strategic backing from Tether—and phased remediation plans to compensate affected depositors.
- **Impact:** Affected users face a recovery model tied to exchange revenue generation, while the Solana perpetual ecosystem sees the protocol restructure its architecture under new risk leadership.
- **Watch:** Drift's upcoming announcements regarding technical launch timelines, deployment dates, and detailed distribution mechanics for the user recovery pool.

Drift Protocol announced that cybersecurity firm Mandiant conclusively attributed its recent security breach to UNC6862, a North Korean state-sponsored threat group [1]. According to an official update published on June 4, 2026, the attacker's operational telemetry, tactics, and techniques matched historical operations run by state-backed actors linked to similar decentralized finance intrusions [1].

To prepare for its upcoming platform relaunch on Solana, the team hired former Helium Head of Protocol Engineering Noah Prince to serve as its Head of Protocol [1]. Prince, who previously managed Helium's network migration to Solana, will lead efforts to restructure the codebase and reinforce platform defenses [1]. Additionally, Drift engaged former members of the Gauntlet team to overhaul risk management and vault mechanics, covering liquidator optimization, liquidation engines, funding rates, and post-launch risk monitoring [1].

## Relaunch Strategy and User Recovery

The protocol stated that its primary goal is deploying a secure, revenue-generating platform to fund a dedicated user recovery pool designed to repay outstanding customer losses [1]. Drift plans to position itself as the primary perpetual exchange denominated in $USDT on Solana, backed by a strategic support package from Tether and additional partners [1].

The initiative follows previously outlined remediation steps, including [token claims and asset redemption efforts](https://basisdesk.news/news/drift-opens-dfx-token-claims-recovery-redemptions) and earlier frameworks for a [$147.5M recovery plan](https://basisdesk.news/news/drift-protocol-recovery-framework-tether-exploit) after the protocol was compromised [1]. Drift said it will disclose further specifics regarding the relaunch schedule and recovery mechanics in subsequent updates [1].

## Sources

1. [Drift Recovery Update – June 3, 2026 | Drift Updates](https://www.drift.trade/updates/drift-recovery-update-june-3-2026) — drift.trade, 2026-10-21

---
Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai