12 Protocols Breached in 15 Days After Drift's $280M Exploit

Twelve crypto protocols and businesses breached in just over two weeks. That is roughly one incident every 28 hours across the DeFi and CeFi stack, starting the day after the $280 million Drift Protocol exploit on April 1. For context, Q1 2026 already saw $168.6 million stolen from 34 protocols, so this April window alone is running at a pace that would exceed the entire prior quarter if it holds.

The incidents are not thematically clean. Some are oracle manipulation, some are access control, some are pure social engineering against humans holding keys. What links them is timing and, in at least two cases, attribution.

What Happened

The trigger event was Drift. As CoinMarketCap reported, the Drift Protocol exploit on April 1 drained $280 million through what investigators describe as a prolonged social engineering attack, with authorities suspecting North Korean-affiliated actors. That is not a smart contract bug story. That is a human-in-the-loop compromise that ended in signed transactions.

What followed reads like a target list working through Q2. CoW Swap, Hyperbridge, Bybit, Dango, Silo Finance, Aethir, MONA, Zerion, Rhea Finance, and Grinex all appear on the tally. The two most recent, Rhea and Grinex, together account for roughly $21 million.

Rhea Finance disclosed on Thursday that an attacker hit its Margin Trading feature through a coordinated pool manipulation against the Rhea Lend smart contract. CertiK put the loss at about $7.6 million. The mechanism, per CertiK: the attacker deployed fake token contracts, seeded liquidity into fresh pools, and used those pools to mislead the protocol's oracle and validation layer.

The same day, Russia-linked exchange Grinex suspended operations after a $13.7 million breach it attributed to "unfriendly states" without further attribution. Earlier in the month: Silo Finance lost $392,000 on April 3 from a misconfigured oracle, Aethir lost $423,000 on April 9 from an access control exploit, and bridge aggregator Dango lost $410,000 on April 13 from a smart contract bug. The Zerion incident, alongside Drift, is attributed to DPRK-affiliated groups using AI-assisted social engineering to lift credentials and funds.

The source does not disclose the exact vector for CoW Swap, Hyperbridge, Bybit, or MONA in this cluster, which matters because we cannot yet tell whether those are variants of the same social engineering campaign or opportunistic copycats riding the news cycle. The bound is set by attribution: at least two of twelve are confirmed DPRK-linked.

Technical Anatomy

Three attack classes dominate this cluster, and they map to different parts of the stack.

First, oracle and pool manipulation. Rhea Finance is the textbook example: spin up fake ERC-style token contracts, provide liquidity to a fresh pool, then use that pool as a price reference the protocol's oracle or validation logic trusts. If the lending contract reads a spot price without sanity bounds, or accepts a pool as canonical without a listing whitelist, the attacker mints borrowing power out of thin liquidity. Silo Finance's $392,000 loss sits in the same family, a misconfigured oracle rather than a novel exploit primitive. Chainlink's own oracle documentation has warned against exactly this pattern for years, specifically the use of unbounded spot AMM prices as collateral references.

Second, access control. Aethir's $423,000 loss came from an access control exploit on a decentralized GPU compute platform. This is the boring, high-frequency class: a privileged function without a proper modifier, a role assignment that was never revoked, an admin key with more scope than the threat model assumed. It is also the class that static analyzers catch reliably, which is why every one of these is a process failure, not a knowledge failure.

Third, and this is the one that should be keeping CTOs up: AI-assisted social engineering. Drift and Zerion both trace to DPRK-affiliated groups using AI tooling to extract credentials and funds. This is qualitatively different from a Solidity bug. The attack surface is your engineering hiring pipeline, your Slack, your Telegram, your Zoom calls with fake candidates or fake auditors. Voice cloning and LLM-driven conversational persistence turn a two-week phishing operation into a two-day one. No amount of formal verification on the contract layer defends against a signer who was social-engineered into approving a malicious upgrade or moving funds to an attacker-controlled multisig.

My read: the Drift-to-Rhea window is not a random cluster. It is what happens when a well-resourced group runs the same playbook against a target list in parallel, with the smart contract exploits (Rhea, Silo, Aethir, Dango) providing cover noise for the higher-value human-layer compromises.

Who Gets Burned

Lending and margin protocols with permissionless listing sit at the top of the exposure list. Rhea's failure mode, fake token contract into fresh pool into oracle read, generalizes to any lending protocol that lets users spin up new markets or that treats a low-liquidity pool as a valid price source. If your protocol has a "list any token" surface and a shared oracle contract, you should assume you are on someone's target list this month.

Bridges and cross-chain aggregators are next. Dango's $410,000 loss is small in dollar terms, but bridges concentrate value and trust assumptions, and Hyperbridge appearing on the cluster list suggests the category is being scanned actively. The 90-day outlook for bridge teams: expect insurance premiums to reprice, expect institutional counterparties to demand fresh audits, and expect at least one more incident before quarter-end.

Centralized exchanges are exposed on a different axis. Bybit and Grinex both appear in the list, and Grinex's $13.7 million loss with its "unfriendly states" framing tells you that geopolitical attribution is now part of the incident response template, not a footnote. Exchanges holding hot wallet balances for market making are the highest-value single targets in the ecosystem, and DPRK groups have historically prioritized them.

Infrastructure providers like Aethir sit in an awkward middle. The dollar loss is modest, but access control exploits on a compute platform are a supply-chain risk for every workload running on top. If a GPU cloud can be compromised for $423,000, the question is not the loss, it's what an attacker with root on inference infrastructure could do next. The source does not disclose whether customer workloads were affected, which is the load-bearing unknown for anyone building on that layer.

Testable prediction: if this pattern continues, we should see at least three more DPRK-attributed incidents against DeFi or CeFi targets before the end of Q2 2026, and the average loss per incident in that subset should exceed $50 million.

Playbook for Crypto and DeFi

This week, not next quarter, engineering and security leads should be doing four things.

One: audit your oracle configuration for any market where a fresh, low-liquidity pool can influence a price feed. If your lending contract reads a spot price from an AMM without a TWAP window, a liquidity threshold, or a listing whitelist, that is the Rhea failure mode and it is exploitable today. Bound the read with sanity checks even if you trust the upstream feed.

Two: treat your engineering hiring and vendor onboarding pipeline as an attack surface. The DPRK playbook now includes AI-assisted personas that hold up over multi-week interview loops. Require in-person or verified-video final rounds for anyone who will touch signing keys or production infrastructure. Assume any unsolicited "auditor" or "security researcher" DM is hostile until proven otherwise.

Three: reduce the blast radius of any single signer. If your multisig thresholds haven't been reviewed since your last funding round, they are stale. The Drift lesson is that social engineering does not defeat cryptography, it defeats governance. Time-locked upgrades, mandatory review windows on privileged calls, and separation of key custody from key usage all reduce the value of a single compromised human.

Four: run an access control audit. Aethir's exploit class is the cheapest to prevent and the most commonly ignored. Every privileged function, every role, every admin key. Slither, static analyzers, and a fresh set of eyes catch most of these in a day.

Key Takeaways

• Twelve protocols breached in about 15 days after the $280M Drift exploit, a pace that would eclipse Q1 2026's $168.6M total across 34 protocols if sustained.
• Rhea Finance ($7.6M) and Grinex ($13.7M) drove roughly $21M of the most recent losses, with Rhea traced to a fake-token oracle manipulation and Grinex attributed vaguely to "unfriendly states".
• Drift and Zerion are both attributed to DPRK-affiliated groups using AI-assisted social engineering, which shifts the primary attack surface from Solidity to humans holding keys.
• The smaller incidents (Dango $410K, Silo $392K, Aethir $423K) map to well-understood classes: smart contract bugs, oracle misconfiguration, access control. All are process failures, not novel primitives.
• Unanswered question with a testable bound: we do not yet know the attack vector for CoW Swap, Hyperbridge, Bybit, or MONA in this cluster. If more than half of those turn out to be DPRK-linked social engineering, this is a coordinated campaign, not a cluster.