DEX

MetaMask developer and security researcher Taylor Monahan said North Korean IT workers have been embedded in crypto companies and DeFi projects for at least seven years, alleging involvement across 40+ DeFi platforms. Her comments followed Drift Protocol's statement of "medium-high confidence" that its recent $280 million exploit was conducted by a North Korea state-affiliated group.

Drift Protocol suffered an exploit in which an attacker drained about $285 million by leveraging pre-signed transactions and manipulating a multi-signature setup to obtain admin access. The incident is being cited as a sign that DeFi threats are increasingly targeting governance and operational control layers rather than only smart-contract bugs. Drift's rapid steps to confirm the attack and pause deposits and withdrawals also underscored how response speed can shape user trust.

DeFi value capture is increasingly tied to active trading, as 24-hour perpetual volume sat near $8.4 billion versus about $3.7 billion in Spot DEX volume. Hyperliquid accounted for roughly $618,377 of $41.45million in total DeFi fees, while its share reached about 36.4% by March 2026. HIP-3 metrics show about $154.95 billion in total volume and $12.43 million in fees, with the last 24 hours sending about $403,475 into buybacks that removed around 10,794 HYPE from circulation.

Ethereum’s on-chain role has shifted toward structured financial activity, with ETH stablecoins at about $166.1 billion and tokenized U.S. Treasuries surpassing $12 billion. Quarterly stablecoin transfer volume is near $8 trillion, yet daily fees sit around $157,000 and ETH issuance continues to exceed burns. DeFi TVL is roughly $52.6 billion and DEX volume about $548 million, while rollups keep base fees near 0.6 Gwei, improving access but limiting direct value capture.

Drift Protocol released a detailed Saturday update on its April 1 incident that drained about $280 million from its Solana perpetuals exchange, describing a roughly six-month social engineering campaign that began around fall 2025. The attackers allegedly posed as a quant firm, met contributors at multiple conferences, and deposited over $1 million into an Ecosystem Vault before obtaining pre-signed approvals and taking control within minutes. Drift and SEAL 911 said they have “medium-high” confidence the operation matches the North Korea-aligned actors behind the $50 million Radiant Capital hack in October 2024, while Mandiant has not yet issued formal attribution.

Drift Protocol said the exploit discovered on Wednesday caused losses of about $280 million, based on external estimates, and described it as a coordinated operation that unfolded over roughly six months. The team said it has “medium-high confidence” the same actors were behind Radiant Capital’s $58 million October 2024 hack, and it is working with law enforcement to reconstruct what happened during the April 1 attack.

Solana co-founder Anatoly Yakovenko described the Drift Protocol incident as "terrifying" after details pointed to a long-running, in-person social engineering operation. Drift Protocol was drained of $270 million and then halted deposits and withdrawals while warning users it was not an April Fools' joke. The report says the attackers built trust from late 2025 through March 2026 before delivering malicious links and software to contributors.

Telegram's Wallet said on April 2 that it will use Lighter to support native leveraged perpetual trading, letting users trade crypto as well as stocks, metals, and oil with up to 50x leverage. The wallet reports more than 150 million registered users, about 25 million of whom are active, while Telegram has over 1 billion users. Lighter's LIT token rallied about 30% and retested $1 after the integration update.

Onchain investigator ZachXBT alleges Circle did not freeze or blacklist roughly $420 million in illicit USDC flows since 2022 across 15 hack-and-fraud cases. He says Circle sometimes had hours or days to act, including cited incidents tied to GMX, Cetus and Drift Protocol, but took limited action or acted after funds were swapped into ETH.

Drift Protocol said a Solana-based perp DEX was exploited on April 1, 2026, with about $286 million removed in roughly 12 minutes after attackers prepared fake collateral and used pre-signed admin transactions. The incident coincided with TVL falling from about $550 million to under $250 million, while DRIFT slid as much as 37%–42% to around $0.04–$0.05. As of April 3, the protocol had sent an onchain outreach message and had not announced a full reimbursement plan.