DEX

Drift Protocol says the April 1 attack that led to a $285,000,000+ loss followed roughly six months of in-person social engineering tied to multiple crypto conferences. The Solana-based DeFi project says the group posed as a quantitative trading firm, onboarded an Ecosystem Vault in December and January, and deposited more than $1 milllion of its own capital before the incident.

Polymarket is overhauling its exchange infrastructure and plans to introduce Polymarket USD, a platform-native token backed 1:1 by USDC. The rollout is expected over the next two to three weeks and includes CLOB v2, new smart contracts, and a collateral migration from USDC.e. The changes arrive as U.S. prediction markets see improving legal clarity around event-based contracts.

MetaMask developer and security researcher Taylor Monahan said North Korean IT workers have been embedded in crypto companies and DeFi projects for at least seven years, alleging involvement across 40+ DeFi platforms. Her comments followed Drift Protocol's statement of "medium-high confidence" that its recent $280 million exploit was conducted by a North Korea state-affiliated group.

Drift Protocol suffered an exploit in which an attacker drained about $285 million by leveraging pre-signed transactions and manipulating a multi-signature setup to obtain admin access. The incident is being cited as a sign that DeFi threats are increasingly targeting governance and operational control layers rather than only smart-contract bugs. Drift's rapid steps to confirm the attack and pause deposits and withdrawals also underscored how response speed can shape user trust.

DeFi value capture is increasingly tied to active trading, as 24-hour perpetual volume sat near $8.4 billion versus about $3.7 billion in Spot DEX volume. Hyperliquid accounted for roughly $618,377 of $41.45million in total DeFi fees, while its share reached about 36.4% by March 2026. HIP-3 metrics show about $154.95 billion in total volume and $12.43 million in fees, with the last 24 hours sending about $403,475 into buybacks that removed around 10,794 HYPE from circulation.

Ethereum’s on-chain role has shifted toward structured financial activity, with ETH stablecoins at about $166.1 billion and tokenized U.S. Treasuries surpassing $12 billion. Quarterly stablecoin transfer volume is near $8 trillion, yet daily fees sit around $157,000 and ETH issuance continues to exceed burns. DeFi TVL is roughly $52.6 billion and DEX volume about $548 million, while rollups keep base fees near 0.6 Gwei, improving access but limiting direct value capture.

Drift Protocol released a detailed Saturday update on its April 1 incident that drained about $280 million from its Solana perpetuals exchange, describing a roughly six-month social engineering campaign that began around fall 2025. The attackers allegedly posed as a quant firm, met contributors at multiple conferences, and deposited over $1 million into an Ecosystem Vault before obtaining pre-signed approvals and taking control within minutes. Drift and SEAL 911 said they have “medium-high” confidence the operation matches the North Korea-aligned actors behind the $50 million Radiant Capital hack in October 2024, while Mandiant has not yet issued formal attribution.

Drift Protocol said the exploit discovered on Wednesday caused losses of about $280 million, based on external estimates, and described it as a coordinated operation that unfolded over roughly six months. The team said it has “medium-high confidence” the same actors were behind Radiant Capital’s $58 million October 2024 hack, and it is working with law enforcement to reconstruct what happened during the April 1 attack.

Solana co-founder Anatoly Yakovenko described the Drift Protocol incident as "terrifying" after details pointed to a long-running, in-person social engineering operation. Drift Protocol was drained of $270 million and then halted deposits and withdrawals while warning users it was not an April Fools' joke. The report says the attackers built trust from late 2025 through March 2026 before delivering malicious links and software to contributors.

Telegram's Wallet said on April 2 that it will use Lighter to support native leveraged perpetual trading, letting users trade crypto as well as stocks, metals, and oil with up to 50x leverage. The wallet reports more than 150 million registered users, about 25 million of whom are active, while Telegram has over 1 billion users. Lighter's LIT token rallied about 30% and retested $1 after the integration update.