The crypto theft that changed everything

(image: via Currency News)

On April 1 this year, a modestly-sized but well-regarded DeFi lender called Drift Protocol posted the sort of message no financial platform ever wants to send, especially on April Fool’s Day. It was under attack. Deposits and withdrawals had been suspended. This was not, the team added, a joke.

By the time the thing was over, roughly $285 million in user assets had gone missing from Drift and the entire premise of DeFi security suddenly looked shaky. Not because of the size of the theft (crypto has seen worse), but because it was not, in the usual sense of the word, a “hack”. It was closer to a confidence trick, a technical feint, a corporate infiltration and a film-worthy spy operation all wrapped in the language of blockchains. The criminal operation was ingenious in its sophistication and unprecedented in scope.

For years DeFi has sold itself as secure finance without the freight of legacy - no banks, no brokers, no clerks, no clearing houses, no marble foyers, no compliance officers. Instead, there is code. The software holds the money, enforces the rules and processes the trades. Trust, we were told, had been removed from the system. So compelling was the story that I wrote a book about it in 2021, titled “Beyond Bitcoin: Decentralised Finance and the End of Banks”.

But time changes many things, including the concept of “trustlessness”. The Drift affair shows something much more interesting and much more worrying. Trust had not been removed from the process of finance by DeFi as the boosters had hoped. It had simply been moved elsewhere.

Understanding what happened requires letting go of the image of a hacker hunting for a flaw in the software. The Drift attackers wrote almost no malicious code. What they constructed instead was an elaborate manipulation, executed over six months with the patience and discipline of a well-funded intelligence operation.

Months before the attack, individuals posing as representatives of a sophisticated quant trading firm began building relationships with Drift. They were professional, credible, and unhurried. Investigators at forensic companies Elliptic, TRM Labs, and Mandiant later concluded, with high confidence, that these individuals were operatives of North Korea’s state-sponsored hacking apparatus - the same group believed responsible for billions in cryptocurrency theft over the past decade.

In parallel, the attackers created a completely fictitious digital currency called CarbonVote, or CVT - the crypto equivalent of printing your own money. CVT was worth nothing. But they invested a modest amount of real money to make it look legitimate by trading it back and forth between accounts they controlled (called “wash trading”) to manufacture a convincing price history of around one dollar per token. Drift accepted it at face value, having no way to detect the wash trading (remember, wallets are anonymous).

But here is the subtlety that makes this attack ingenious. Fraudulent collateral alone was never going to be enough. DeFi platforms are engineered with multiple layers of protection against exactly this kind of manipulation. When you borrow against collateral, the platform only allows you to borrow a fraction of its stated value - typically sixty to eighty per cent - a cushion against sudden price collapses. Withdrawal speeds are capped. Automated risk systems throttle any large transaction involving a new or thinly-traded asset. Even if Drift accepted CVT as legitimate collateral worth one dollar per token, these safeguards would have choked the theft long before the attackers got anywhere near $285 million.

What the attackers needed was not just to fool the system. They needed to seize the administrative controls that govern those protections and rewrite them. To declare CVT eligible as collateral at one hundred per cent of face value. To remove withdrawal speed limits. To disable the automated risk alerts. To, in effect, strip out every safeguard standing between their worthless tokens and a quarter of a billion dollars in real assets.

Drift, like most DeFi platforms, was governed by a Security Council of five trusted individuals who held the authority to make major rule changes (there you have it – humans in the loop). Important decisions required at least two of the five to sign off - like a bank vault requiring two separate keys held by two different managers. The attackers, having spent months building relationships with the small team of developers who maintained and governed Drift, induced council members to sign what appeared to be routine administrative authorisations. The kind of paperwork that accumulates in any governance process and, over time, gets reviewed with diminishing scrutiny.

What the signers could not easily see was what was buried in the technical payload of each authorisation. These documents were presented not in plain language but in dense, compressed code. Hidden among the routine instructions (in identical formatting, indistinguishable to the eye) was an additional clause granting the attackers the power to rewrite the platform’s lending rules - which assets could be used as collateral, how much could be borrowed against them, and what limits applied to withdrawals. Think of it as a company director signing a three-page board resolution, standard language seen dozens of times before, not noticing that page two contains a sentence transferring signing authority over all company accounts to an unknown third party.

They signed. The authorisations sat dormant, waiting. Then, on 27 March, Drift’s own team removed a safeguard called a timelock - a mandatory waiting period of one to three days imposed on any major platform change, during which the community can review it and raise the alarm. It was removed in the name of operational efficiency. The pre-signed instructions the attackers were holding became live the instant it was gone.

The attackers executed 31 withdrawals in roughly 12 minutes. Insurance company Nexus Mutual’s incident report says the preparation had taken around six months. The attackers allegedly created false identities and met Drift contributors in person across several countries, joined conversations, asked plausible questions, deposited more than US$1 million into the ecosystem, and built up the sort of slow, tedious credibility that makes fraud work.

That is why some security people are treating Drift as a pivot moment. Crypto security company Cyfrin’s Patrick Collins argued that the attack “changes everything” about Web3 security, precisely because it was not a classic smart-contract bug. It was an entirely different hybrid intelligence scam - social, technical, detailed, project planned and executed .

This is a profound problem for DeFi. The industry has spent years saying, in effect: trust the code. But who updates the code? Who has emergency powers? Who can approve a new asset? Who can change the rules? Who can be fooled? Who can be charmed? Who can be compromised? Who, after two drinks at a crypto conference in Singapore, thinks a new quant-trading partner seems perfectly legit?

This is why Drift matters - it was not just a theft, it was a negative audit of the entire DeFi worldview. It deceived the signers, the governance, the emergency controls, the fake-asset filters, the wallet screens, the incident response and the social gullibility of an industry that mistakes technical fluency for trustworthiness.

So is DeFi dead? Of course not - financial systems often become safer after disasters. Aviation improves after crashes. Banking improved after runs. Software improves after failures sufficiently expensive to focus the mind.

But what this means is that DeFi security can no longer mean “we audited the code”.

The next version of DeFi needs systems and processes that humans can actually understand before approving anything. It needs delays before dangerous changes take effect. It needs alarms that stop absurd withdrawals automatically. It needs fewer heroic assumptions and more boring old-world controls.

Above all, it needs to abandon one of crypto’s most seductive myths: that technology can eliminate trust.

It turns out that it cannot, not really.

Steven Boykey Sidley is a professor of practice at JBS, University of Johannesburg, a partner at Bridge Capital and a columnist-at-large at Daily Maverick, Currency News and Daily Friend. His new book, It’s Mine: How the Crypto Industry is Redefining Ownership, is published by Maverick451 in South Africa and Legend Times Group in the UK/EU, available now.