Blockchain analytics company Elliptic on Thursday flagged “several indications” that North Korea’s state-sponsored hackers might lag the $285 million exploit of Wander Procedure, the biggest DeFi hack of 2026 up until now that eliminated majority of the Solana-based exchange’s overall worth locked.
Arthur Hayes, BitMEX co-founder, Maelstrom CIO, and Wander Procedure consultant, blamed Solana (CRYPTO: SOL) itself.
” If Solana had native multi sig addresses, would the Wander hack even have been possible? Really curious, not trolling,” Hayes composed on X.
Journal CTO Charles Guillemet drew a direct contrast to the $1.4 billion Bybit hack of 2025, which the FBI credited to North Korea’s Lazarus Group.
The pattern is almost similar: jeopardized multi sig signers, social engineering, and destructive deals camouflaged as regular operations.
The Lazarus Playbook
The hacker invested weeks establishing the attack.
They developed a phony token called CarbonVote Token, seeded it with $500 in liquidity, and wash-traded it to deceive Solana rate oracles into treating it as genuine.
On April 1, they utilized jeopardized admin secrets to note the token on Drift, published it as security, and drained pipes genuine properties in 31 deals over approximately 12 minutes.
Elliptic’s report kept in mind the attack’s pre-positioned wallets, early test deals, and structured laundering circulation all mirror previous Lazarus operations.
The company stated this would represent the eighteenth DPRK-linked act it has actually tracked in 2026, with over $300 million taken this year alone.
North Korean hackers supposedly took a record $2 billion in crypto in 2025, according to Chainalysis. The U.S. Treasury has actually connected taken crypto properties to Pyongyang’s weapons of mass damage program.
Circle Rested On Its Hands
Circle had actually frozen 16 unassociated company hot wallets simply days previously in a sealed civil case. ZachXBT called the contrast proof that Circle is a bad star for the market.
Benzinga connected to Circle for remark. Circle is down 2% today, and 13% year to date.
Drift’s TVL collapsed from $550 million to under $300 million within the hour. The DRIFT token crashed over 40%. SOL fell 9% to an intraday low near $78.60.
Solana Structure President Lily Liu stated the event “strikes tough” however worried the genuine targets are now “people: social engineering and opsec weak points more than code exploits.”
Image: Shutterstock