The crypto theft that changed everything

On April 1, a well-regarded decentralised finance (DeFi) lender called Drift Protocol posted the sort of message no financial platform ever wants to send, especially on April Fool’s Day. It was under attack. Deposits and withdrawals had been suspended. This was not, the team added, a joke.

By the time it was over, roughly $285m in user assets had gone missing and the entire premise of DeFi security suddenly looked shaky. Not because of the size of the theft – crypto has seen worse – but because it was not, in the usual sense of the word, a “hack”. It was closer to a confidence trick, a technical feint and a film-worthy spy operation all wrapped in the language of blockchains.

For years DeFi has sold itself as secure finance without the freight of legacy – no banks, no brokers, no clearing houses, no marble foyers, no compliance officers. Instead, there is code. The software holds the money, enforces the rules and processes the trades. Trust, we were told, had been removed from the system. So compelling was the story that I wrote a book about it in 2021, titled Beyond Bitcoin: Decentralised Finance and the End of Banks.

But time changes many things, including the concept of “trustlessness”. Trust had not been removed from finance by DeFi as the boosters had hoped. It had simply been moved elsewhere.

The Drift attackers wrote almost no malicious code. What they constructed instead was an elaborate manipulation, executed over six months with the patience of a well-funded intelligence operation.

Rewriting the rules

Months before the attack, individuals posing as a sophisticated quant trading firm began building relationships with Drift. They were professional, credible and unhurried. Forensic firms Elliptic, TRM Labs and Mandiant later concluded, with high confidence, that they were operatives of North Korea’s state-sponsored hacking apparatus – the same group believed to be responsible for billions in cryptocurrency theft over the past decade.

In parallel, the attackers created a fictitious digital currency called CarbonVote, or CVT – the crypto equivalent of printing your own money. CVT was worth nothing. But they invested a modest amount of real money to make it look legitimate, trading it back and forth between accounts they controlled (a practice called “wash trading”) to fabricate a convincing price history of about $1 per token. Drift accepted it at face value, having no way to detect the wash trading (remember, wallets are anonymous).

But here is the subtlety. Fraudulent collateral alone was never going to be enough. DeFi platforms are engineered with multiple layers of protection against exactly this kind of manipulation. When you borrow against collateral, the platform only allows you to borrow a fraction of its stated value – typically 60%-80% – a cushion against sudden price collapses. Withdrawal speeds are capped. Automated risk systems throttle any large transaction involving a new or thinly traded asset. Even with CVT accepted as legitimate collateral, these safeguards would have choked the theft long before the attackers got anywhere near $285m.

What the attackers needed was to seize the administrative controls that govern those protections and rewrite them. To declare CVT eligible at 100% of face value. To remove withdrawal limits. To disable the risk alerts. To strip out every safeguard between their worthless tokens and a quarter of a billion dollars in real assets.

12 minutes, 31 withdrawals

Drift, like most DeFi platforms, was governed by a “Security Council” of five trusted individuals who held the authority to make major rule changes (there you have it – humans in the loop). Important decisions require at least two of the five to sign off – like a bank vault, which requires two keys held by two different managers. Having spent months building relationships with Drift’s developers, the attackers induced council members to sign what appeared to be routine administrative authorisations – the kind of paperwork that accumulates in any governance process and, over time, gets reviewed with diminishing scrutiny.

What the signers could not easily see was buried in the technical payload of each authorisation. These documents were presented not in plain language but in dense, compressed code. Hidden among the routine instructions, in identical formatting, was a clause granting the attackers the power to rewrite the platform’s lending rules. Think of it as a director signing a three-page board resolution, standard language seen dozens of times, not noticing that page two transfers signing authority over all company accounts to an unknown third party.

They signed. The authorisations sat dormant, waiting. Then, on March 27, Drift’s own team removed a safeguard called a timelock – a mandatory waiting period of one to three days imposed on any major platform change, during which the community can review it and raise the alarm. It was removed in the name of operational efficiency. The pre-signed instructions became live the instant it was gone.

The attackers executed 31 withdrawals in roughly 12 minutes. Drift’s own post-mortem, published on April 5, says the preparation took around six months. The attackers allegedly created false identities and met Drift contributors in person across several countries, joined conversations, asked plausible questions, deposited more than $1m into the ecosystem, and built the sort of slow, tedious credibility that makes fraud work.

Trust the code

That is why some security people are treating Drift as a pivot moment. Cyfrin’s Patrick Collins says the attack “changes everything” about Web3 security, precisely because it was not a classic smart-contract bug. It was a hybrid intelligence scam – social, technical, detailed, project-planned and executed.

The industry has spent years saying, in effect: trust the code. But who updates the code? Who has emergency powers? Who can approve a new asset? Who can be fooled? Who can be charmed? Who, after two drinks at a crypto conference in Singapore, thinks a new quant trading partner seems perfectly legit?

This is why Drift matters – it was not just a theft, it was a negative audit of the entire DeFi worldview. It deceived the signers, the governance, the emergency controls, the fake-asset filters, the incident response and the social gullibility of an industry that mistakes technical fluency for trustworthiness.

So, is DeFi dead? Of course not – financial systems often become safer after disasters. Aviation improves after crashes. Banking improved after runs. Software improves after failures sufficiently expensive to focus the mind.

But DeFi security can no longer mean “we audited the code”. The next version needs systems that humans can actually understand before anything is approved. It needs delays before dangerous changes take effect. It needs alarms that automatically stop absurd withdrawals. It needs fewer heroic assumptions and more boring old-world controls.

Above all, it needs to abandon one of crypto’s most seductive myths: that technology can eliminate trust.

It turns out that it cannot, not really.

Steven Boykey Sidley is a professor of practice at the Johannesburg Business School, University of Johannesburg, a partner at Bridge Capital, and a columnist at Daily Maverick, Currency and Daily Friend.

ALSO READ:

• AI won’t crack the blockchain. It’ll burn everything else
• When agentic AI goes rogue with crypto
• Inside a digital scam that cost a billionaire $400m

_{Top image: Rawpixel; Currency.}