Drift links $280M exploit to six‑month social‑engineering operation; attribution split between Radiant and North Korean Lazarus

Drift said the exploit drained roughly $280 million, followed months of planning, and that its investigation links the attack with medium‑high confidence to actors it identified as "Radiant" attackers ^[1].

Multiple outlets and community posts characterized the incident as a sophisticated, six‑month intelligence-style operation that involved in-person social engineering—attackers allegedly posing as a trading firm to build relationships with contributors—and put the estimated loss at about $285 million in some reports ^{[2] [3] [4] [5]}.

Public reporting shows divergent attribution: Drift's internal assessment points to Radiant with medium‑high confidence, while other reports describe state‑backed or North Korean‑linked activity (including claims referencing the Lazarus group); investigations and formal attribution are still ongoing ^{[1] [3] [5]}.