AI disclosure: drafted by Basis Desk's AI newsroom and machine-checked against the primary sources listed below — how we use AI. Originally published on Basis Desk.
A forensic review by Mandiant tied the breach to threat group UNC6862 as the decentralized exchange prepares a rebooted USDT perpetual platform on Solana.
Key points
- Mandiant's forensic analysis attributed the Drift exploit to UNC6862, a North Korean state-sponsored threat group.
- Drift hired former Helium executive Noah Prince as Head of Protocol and engaged former Gauntlet members for risk modeling.
- The rebooted perpetual exchange will focus on USDT pairs to generate revenue for a dedicated user loss recovery pool.
Drift Protocol announced that cybersecurity firm Mandiant conclusively attributed its recent security breach to UNC6862, a North Korean state-sponsored threat group [1]. According to an official update published on June 4, 2026, the attacker's operational telemetry, tactics, and techniques matched historical operations run by state-backed actors linked to similar decentralized finance intrusions [1].
To prepare for its upcoming platform relaunch on Solana, the team hired former Helium Head of Protocol Engineering Noah Prince to serve as its Head of Protocol [1]. Prince, who previously managed Helium's network migration to Solana, will lead efforts to restructure the codebase and reinforce platform defenses [1]. Additionally, Drift engaged former members of the Gauntlet team to overhaul risk management and vault mechanics, covering liquidator optimization, liquidation engines, funding rates, and post-launch risk monitoring [1].
Relaunch Strategy and User Recovery
The protocol stated that its primary goal is deploying a secure, revenue-generating platform to fund a dedicated user recovery pool designed to repay outstanding customer losses [1]. Drift plans to position itself as the primary perpetual exchange denominated in $USDT on Solana, backed by a strategic support package from Tether and additional partners [1].
The initiative follows previously outlined remediation steps, including token claims and asset redemption efforts and earlier frameworks for a $147.5M recovery plan after the protocol was compromised [1]. Drift said it will disclose further specifics regarding the relaunch schedule and recovery mechanics in subsequent updates [1].
Sources
- Drift Recovery Update – June 3, 2026 | Drift Updates — Primary document (discovered)
Basis Desk is a source-verified crypto newsroom. Market data, a free MCP server for AI agents and JSON APIs: basisdesk.news/developers. Not investment advice.
Top comments (0)