Solana North Korea Shadow Drift Protocol Attack — $285 Million1 This attack, which took place on April 1, 2026, became the second-largest DeFi hack in Solana history. And the most frightening part is this: it was not a code vulnerability.How was it done?The North Korean hacker group secretly monitored Drift Protocol for 6 months and undermined it from withinThey took control of a privileged AWS signing keyThey used Solana's legitimate "durable nonces" (persistent nonce) mechanism as a weaponThey drained all user vaults, including USDC, JLP, SOL, and wrapped BTCThe attack shares the same on-chain fund flow patterns as the 2024 Radiant Capital hacks — meaning the same groupDrift froze all protocol functions, reported addresses to exchanges, and changed signer wallets.#GateSquareAprilPostingChallenge