When Drift disclosed the details behind its $270 million exploit, the most unsettling part wasn’t the scale of the loss — it was how it happened.

According to the team behind the protocol, the attack wasn’t a smart contract bug or a clever piece of code manipulation. It was a six-month campaign involving fake identities, in-person meetings across multiple countries and carefully cultivated trust. The attackers, allegedly from North Korea, didn’t just find a vulnerability in the system. They became part of it.

This new threat is now forcing a broader reckoning across decentralized finance.

For years, the industry has treated security as a technical problem, something that could be solved with audits, formal verification and better code. But the Drift incident suggests something far more complex: that the real vulnerabilities may lie outside the codebase altogether.

Alexander Urbelis, chief information security officer (CISO) at ENS Labs, argues the framing itself is already outdated.

“We need to stop calling these ‘hacks’ and start calling them what they are: intelligence operations,” Urbelis told CoinDesk. “The people who showed up at conferences, who met Drift contributors in person across multiple countries, who deposited a million dollars of their own money to build credibility: that’s tradecraft. It’s the kind of thing you’d expect from a case officer, not a hacker.”

If that characterization holds, then Drift represents a new playbook: one where attackers behave less like opportunistic hackers and more like patient operators embedding themselves socially before making a move onchain.

“North Korea isn’t scanning for vulnerable contracts anymore. They’re scanning for vulnerable people… That’s not hacking. That’s running agents,” Urbelis added.

The tactics themselves aren’t entirely new.

Investigations in recent years have shown North Korean operatives infiltrating crypto firms by posing as developers, passing job interviews and even securing roles under fake identities. But the Drift incident suggests those efforts have escalated — from gaining access through hiring pipelines to running months-long, in-person relationship-building operations before executing an attack.

‘The Achilles’ heel’

That shift is what has many security leaders most concerned. Even the most rigorously audited protocol can still fail if a contributor is compromised.

David Schwed, chief operating officer of SVRN and a former CISO at both Robinhood and Galaxy, sees the Drift case as a wake-up call.

“Protocols need to understand what they’re up against. These aren’t simple exploits. These are well-planned, months-long operations with dedicated resources, fabricated identities, and a deliberate human element,” Schwed told CoinDesk. “That human element is the Achilles’ heel for many organizations.”

Many DeFi teams remain small, fast-moving and built on trust. But when a handful of individuals control critical access, compromising one can be enough.

Schwed argues that the response needs to be updated. “The answer is a well-fortified security program that protects not just the technology, but the people and the process… Security needs to be foundational to the project and the team.”

Some protocols are already adjusting. At Jupiter, one of Solana’s largest DeFi platforms, the baseline of audits and formal verification remains, but leaders claim it’s no longer sufficient.

“Clearly, securing code via multiple independent audits, open sourcing, and formal verification is just table stakes. The surface area for attacks has broadened substantially,” said COO Kash Dhanda.

That broader surface now includes governance, contributors and operational security. Jupiter has expanded its use of multisigs and timelocks while investing in detection systems and internal training.

“Given that flesh is more vulnerable than code, we’re also updating opsec training and monitoring for key team members,” Dhanda said.

Even then, he added, “there is no end-state for security” and complacency remains the biggest risk.

For protocols like dYdX, the Drift incident reinforces a reality that can’t be engineered away entirely.

“It’s an unfortunate fact of life that crypto projects are being increasingly targeted by state-sponsored bad actors… developers must take precautions to prevent and mitigate the impact of social engineering compromises, but users should also be aware that given the increasing sophistication of bad actors the risk of such compromises cannot be totally eliminated,” said David Gogel, COO of dYdX Labs.

That evolving threat model is also shifting responsibility toward users themselves.

“Users who are active in DeFi should take the time to understand the technical architecture of protocols or smart contracts that hold their funds, and should factor into their risk assessments the role and nature of any multisigs for software upgrades and the possibility that those could be maliciously compromised,” Gogel added.

‘Threat model’

For some founders, the Drift exploit underscores a more uncomfortable conclusion: that trust itself has become a vulnerability.

“The Drift exploit wasn’t a code vulnerability. It was a six-month intelligence operation that exploited trust between humans,” said Lucas Bruder, CEO of Jito Labs.

In practice, that means designing systems that assume compromise — not just bugs.

“Smart contract audits are table stakes. The real attack surface is your team, your multisig signers, and every device they touch.”

That mindset is becoming central to how DeFi approaches security. Schwed of SVRN says it starts with asking not just how a protocol works, but how it could fail.

“Start with a threat model. Ask yourself, how can I be exploited? If one of the project owners becomes compromised, what’s the blast radius of that scenario?”

In that sense, the Drift exploit may be remembered less for the funds lost than for what it revealed — that the biggest risks in DeFi may no longer live in the code, but in the people who run it.

Read more: How North Korea Infiltrated the Crypto Industry

The Solana Foundation announced a suite of security initiatives on Monday, just five days after decentralized finance (DeFi) platform Drift Protocol suffered a $270 million exploit carried out by a North Korean state-affiliated group following a six-month social engineering campaign.

The centerpiece is Stride, a structured evaluation program led by Asymmetric Research that will assess Solana DeFi protocols against eight security pillars and publish its findings publicly. The foundation also introduced the Solana Incident Response Network (SIRN), a membership-based group of security firms and researchers focused on real-time crisis response.

The initiatives address part of the problem exposed by Drift, but not the mechanics that actually caused the loss. Drift’s smart contracts were not compromised, and its code passed audits. The vulnerability was human: The attackers spent six months building relationships with Drift contributors and compromised their devices through a malicious code repository and a fake TestFlight app.

Under Stride, protocols with more than $10 million in total value locked (TVL) that pass the evaluation will receive ongoing operational security and active threat monitoring funded by Solana Foundation grants, with coverage calibrated to each protocol’s risk profile.

For protocols with more than $100 million in TVL, the foundation will also fund formal verification, a mathematical method that checks every possible execution path in a smart contract to guarantee correctness.

In addition to Asymmetric Research, founding members include OtterSec, Neodyme, Squads, and ZeroShadow. The network is available to all Solana protocols but prioritized by TVL.

Stride’s formal verification, however, would not have caught the North Korean attack, which used the compromised devices to obtain multisig approvals that were then locked into durable nonce transactions and executed weeks later.

Neither would 24/7 monitoring of onchain activity, because the transactions were valid by design and indistinguishable from legitimate administrative actions until they were used to drain the vaults. The attack exploited the gap between onchain correctness and offchain human trust, a gap no smart contract audit or monitoring tool is built to cover.

SIRN, however, could have helped with the response. ZachXBT, an onchain security expert, criticized stablecoin issuer Circle Internet (CRCL) for failing to freeze over $230 million of its stolen dollar-pegged USDC during a six-hour window after the attack began.

A dedicated incident response network with established relationships to bridge operators, exchanges and stablecoin issuers might have shortened the response time. Whether it would have been fast enough to prevent the Wormhole bridging and obfuscation through Tornado Cash is an open question.

The foundation was careful to note that the programs “do not transfer the underlying responsibility away from the protocols themselves,” a line that reads differently after Drift’s postmortem revealed that individual contributor devices were the entry point for a nation-state attack.

Solana already hosts several free security tools for builders, including Hypernative for threat detection, Range Security for real-time monitoring, and Neodyme’s Riverguard for attack simulation.

Cryptocurrency investment products recorded minor inflows last week despite mixed geopolitical signals and increasingly hawkish investor expectations.

Global crypto exchange-traded products (ETPs) clocked $224 million in inflows last week, following a $414 million outflow a week before, CoinShares reported on Tuesday.

The fresh inflows brought total assets under management to about $131.8 billion, roughly in line with levels seen at the same time last year. Year-to-date inflows also totaled about $1.2 billion, compared with $960 million over the same period last year.

The inflows marked a brief rebound in sentiment before later-week macro data and policy expectations reversed momentum, CoinShares head of research James Butterfill said.

XRP leads inflows as Bitcoin trails closely

XRP (XRP) led inflows with about $120 million, contributing more than half of net weekly inflows.

The gains marked XRP’s largest weekly inflows since mid-December 2025, Butterfill noted, bringing its year-to-date inflows to $159 million.

Bitcoin (BTC) ETPs followed closely with $107 million of inflows, bringing year-to-date flows to slightly above $1 billion. Of those gains, only around $22 million was contributed by US spot Bitcoin exchange-traded funds (ETFs), which remain in negative territory year-to-date.

Solana (SOL) also saw minor inflows totaling around $35 million last week, with steady inflows this year representing 10% of total assets under management.

On the other hand, Ether (ETH) investment products continued to lag, posting $53 million in outflows. That followed $222 million in outflows the prior week, bringing year-to-date outflows to $327 million.

Related: CoinShares stock makes US debut on Nasdaq following SPAC merger

CoinShares’ Butterfill attributed the negative sentiment around Ether to developments tied to the CLARITY Act, a major piece of crypto legislation closely linked to stablecoins, which are largely issued on the Ethereum blockchain. Following months of delays, US Senate Banking Committee member Bill Hagerty said Monday that he expects a potential path for the bill in the coming weeks.

Geographically, Switzerland led last week’s inflows at roughly $157 million, followed by Germany and the US, which both recorded about $28 million each, and Canada with $11 million.

Magazine: Your guide to surviving this mini-crypto winter