Drift says April hack stole $295.4M, links attack to North Korean group

About $295.4 million in user funds was stolen in the April 1 hack, and the attacker has been identified as North Korea-linked threat group UNC6862, the Drift Foundation said on X. The foundation said it had investigated the incident and tracked the fund flows with Mandiant, zeroShadow and SEAL 911, adding that Mandiant identified the attacker as UNC6862. The stolen funds were bridged to the Ethereum network, where a total of about 130,259 ETH was held across four wallets. Of that, 107,165 ETH in three wallets has not moved so far. From the remaining wallet, about 23,094 ETH was sent to Tornado Cash on July 23. About $9.2 million in stolen funds has been frozen so far. The foundation said it is working with law enforcement agencies and zeroShadow to track the related wallets and fund movements, and plans to transfer any recovered funds to the DFX recovery pool.