Drift Protocol Attributes Exploit to North Korea, Taps Helium and Gauntlet Veterans for Relaunch

AI disclosure: drafted by Basis Desk's AI newsroom and machine-checked against the primary sources listed below — how we use AI. Originally published on Basis Desk.

A forensic review by Mandiant tied the breach to threat group UNC6862 as the decentralized exchange prepares a rebooted USDT perpetual platform on Solana.

Key points

• Mandiant's forensic analysis attributed the Drift exploit to UNC6862, a North Korean state-sponsored threat group.
• Drift hired former Helium executive Noah Prince as Head of Protocol and engaged former Gauntlet members for risk modeling.
• The rebooted perpetual exchange will focus on USDT pairs to generate revenue for a dedicated user loss recovery pool.

Drift Protocol announced that cybersecurity firm Mandiant conclusively attributed its recent security breach to UNC6862, a North Korean state-sponsored threat group [1]. According to an official update published on June 4, 2026, the attacker's operational telemetry, tactics, and techniques matched historical operations run by state-backed actors linked to similar decentralized finance intrusions [1].

To prepare for its upcoming platform relaunch on Solana, the team hired former Helium Head of Protocol Engineering Noah Prince to serve as its Head of Protocol [1]. Prince, who previously managed Helium's network migration to Solana, will lead efforts to restructure the codebase and reinforce platform defenses [1]. Additionally, Drift engaged former members of the Gauntlet team to overhaul risk management and vault mechanics, covering liquidator optimization, liquidation engines, funding rates, and post-launch risk monitoring [1].

Relaunch Strategy and User Recovery

The protocol stated that its primary goal is deploying a secure, revenue-generating platform to fund a dedicated user recovery pool designed to repay outstanding customer losses [1]. Drift plans to position itself as the primary perpetual exchange denominated in $USDT on Solana, backed by a strategic support package from Tether and additional partners [1].

The initiative follows previously outlined remediation steps, including token claims and asset redemption efforts and earlier frameworks for a $147.5M recovery plan after the protocol was compromised [1]. Drift said it will disclose further specifics regarding the relaunch schedule and recovery mechanics in subsequent updates [1].

Sources

1. Drift Recovery Update – June 3, 2026 | Drift Updates — Primary document (discovered)

Basis Desk is a source-verified crypto newsroom. Market data, a free MCP server for AI agents and JSON APIs: basisdesk.news/developers. Not investment advice.