The evidence
Elliptic reported that the April 1, 2026 Drift incident involved approximately $286 million in stolen assets. Its analysis described assets being converted into USDC on Solana, moved to Ethereum and subsequently converted into ether.
The firm described the activity as consistent with a suspected North Korean connection. That attribution is an analytical assessment reported by Elliptic, not an identity independently established by FOLITIC.
Source: Elliptic analysis published April 2, 2026 and updated April 7, 2026.
FOLITIC analysis
An incident can generate a large volume of transactions without representing ordinary investor demand. Converting stolen assets and moving them between networks may increase exchange and bridge activity while conveying little about the preferences of legitimate holders.
The sequence matters more than any isolated transfer. Analysts should separate the initial unauthorized movement, subsequent conversions and later dispersal. A single headline number should not be repeated at each stage as if additional funds were stolen every time.
Exposure also needs careful wording. Receiving funds from a linked address does not automatically establish that a recipient knowingly participated in an attack. Exchanges, liquidity pools and other services may handle transactions from many unrelated users.
What to watch
Follow documented incident updates, recovery announcements and clearly labeled address evidence. Keep suspected attribution separate from confirmed transaction records. Avoid presenting an attacker’s conversion into a particular token as an investment signal for that asset.
Image: Close photograph of a circuit board, illustrating computing infrastructure. Credit: Jonathan Cutrer from San Angelo, Texas, United States via Wikimedia Commons. Image license: CC BY 2.0. Displayed with a responsive crop. This illustrative image does not depict the reported transaction.
