Drift Hack Analysis: Four DPRK Wallets, Flagged on Behavior Alone

On April 1, 2026, Drift Protocol, the largest perpetual futures exchange on Solana, lost approximately 286 million US dollars in what became the largest DeFi hack of the year. The attackers did not break any cryptography. They spent months posing as a quantitative trading firm to build trust with the protocol's contributors, then exploited privileged access to seize administrative control and drain the protocol. Within days, Elliptic, TRM Labs, and Chainalysis had independently linked the on-chain behavior and laundering methodology to the Democratic People's Republic of Korea.

This case study is not another incident recap. Those are already published by Elliptic and Chainalysis. What this study does is take the four Ethereum wallets that Drift Protocol itself publicly named as holding the stolen funds, run each one through the CredScore risk engine with no special configuration, and publish the result. The engine had no sanctions match and no entity label for any of these addresses. To CredScore, they were four anonymous strings of hex.

Every screenshot below is unedited output from a production CredScore analysis. The scoring logic is deterministic. No machine learning. Every flag has a written rationale, and every score traces back to an observable on-chain signal.

The four wallets Drift named

On April 3, 2026, the Drift team sent on-chain messages to the addresses holding the bridged proceeds, publicly identifying four Ethereum wallets. Those addresses, and the balance and inbound-source count CredScore observed for each at analysis time:

Together the four held roughly 130,000 ETH at analysis time, worth hundreds of millions of dollars. Every one shared the same shape: value flowing in from dozens of distinct sources over about two months, and zero outbound transfers. Money in from everywhere, nothing out.

The verdict: four for four

The verdict was identical across all four addresses: High Risk, a score of 38 out of 100, and an Escalate decision posture, at 72 percent confidence. There was no manual review step and no list lookup that produced this. The engine reached it from the observable behavior of each wallet.

Wallet 1: the primary risk driver

The headline driver is a single behavioral pattern. CredScore describes it directly in the briefing: the wallet has accumulated large value almost entirely through inbound transfers from many sources, holds it without spending, and has no recognized exchange or known-good funding context. A large balance with an unexplained origin is not treated as a trust signal. It is a common holding pattern for stolen or illicit proceeds, and the engine says so, and recommends escalation until provenance is established.

Wallet 2: the written analyst briefing

The briefing is the part a compliance analyst actually reads. It is assembled deterministically from the signal output, so every sentence is tied to a real value in the analysis. This matters for defensibility: a written justification that an auditor reviews months later has to match the numeric evidence exactly, not paraphrase it or embellish it.

Wallet 3: the transparent signal breakdown

This is the part that separates a defensible engine from a guess. Every signal that moved the score is shown with its point value and a written reason. The accumulation pattern and the rapid-inflow behavior pull the score down. A handful of coverage signals nudge it up. The arithmetic is visible, deterministic, and reproducible. Run the wallet again tomorrow and you get the same breakdown.

Wallet 4: no sanctions, no attribution, escalated anyway

This is the whole point of the study in one screenshot. The fourth wallet carries no sanctions designation, no entity label, and no mixer exposure. Every signal a list-based tool relies on comes back empty. And CredScore still escalates it, because the behavior is what gives it away, not a database entry.

Why this matters for compliance

Sanctions lists and attribution databases are lagging indicators. They get populated after investigators, victims, or governments do the work of proving a wallet is dirty, which can take days, weeks, or longer. In the gap between when stolen funds start moving and when an address finally lands on a list, a screening tool that only checks lists is blind. That gap is exactly where a compliance desk is most exposed.

Behavioral analysis closes that gap. The accumulation pattern that flagged all four Drift wallets was visible on-chain from the moment the funds arrived, long before any list could have caught up. CredScore reached the same conclusion a human investigation reached, using only the behavior that was observable the entire time. For a compliance team, the value is simple: an address does not have to be on a list to be dangerous, and the engine will tell you to stop and look before the list catches up.

What this study does not claim

An honest case study has to draw its own boundaries, so here are three things this analysis is explicitly not.

This is retrospective, not a discovery. The four wallets were already public when CredScore analyzed them. Drift Protocol and the analytics firms traced and attributed the funds through their own incident response, weeks before this analysis. CredScore did not catch the hack first and did not identify the attackers. The claim is narrower and still meaningful: the engine independently reaches the Escalate verdict with none of the attribution that was later established.

CredScore did not analyze the Solana side. The exploit happened on Solana, but the stolen funds were bridged to Ethereum, and the four wallets Drift named are Ethereum addresses. CredScore analyzed the Ethereum side only. Solana coverage is on the roadmap.

The verdict is decision support, not a legal conclusion. Unexplained high-value accumulation is a review trigger, not proof of wrongdoing. The same shape can describe a legitimate cold wallet, which is precisely why the engine says escalate and investigate, not guilty. In this case the wallets were independently confirmed to hold stolen funds, which is what makes them a useful ground-truth test.

What this case study proves

Four wallets, publicly confirmed to hold the proceeds of a major DPRK-linked exploit, none of them on any sanctions list, none of them carrying entity attribution. CredScore assigned all four its highest-risk Escalate verdict from observable behavior alone, with a written briefing and a signal-by-signal breakdown for each, produced in seconds, with no machine learning anywhere in the pipeline.

Enterprise blockchain analytics tools can reach comparable conclusions on these wallets, but behind a large annual contract and a multi-week procurement process. If you want a feature-by-feature comparison, see CredScore vs Chainalysis, CredScore vs TRM Labs, and CredScore vs Elliptic.

Run a wallet you already know

The best way to judge CredScore is not to read a case study. It is to paste in an address whose risk profile you already know and see whether the engine agrees with you. If you work in this field, you have a list of wallets where you know the right answer. Run a few and find out.

Frequently asked questions

Sources and further reading

• Drift Protocol on-chain messages identifying the four ETH wallets (April 3, 2026)
• Elliptic: Drift Protocol exploited for $286 million in suspected DPRK-linked attack
• Chainalysis incident analysis: lessons from the Drift hack
• TRM Labs: North Korean hackers attack Drift Protocol
• DL News and CoinDesk reporting on the Drift exploit and attribution (April 2026)
• CredScore engine documentation at /docs