Unchained Daily
Posts
Drift Hack Fingerprints Point to North Korea

Drift Hack Fingerprints Point to North Korea

Plus: 📉 Bitcoin hits its 2026 low, 🚀 x402 Foundation launches, 😓 Bitcoin miners dropping staff and coins

Laura Shin
April 03, 2026

Hi! In today's edition:

🚨 Analytics firms say that North Korean hackers were likely behind the attack that drained $285 million from Drift Protocol
📉 Bitcoin fell to its 2026 low of $65,834 after Trump vowed to hit Iran "extremely hard," with Brent crude topping $106 a barrel before a partial recovery on Hormuz diplomacy
🤖 The x402 Foundation — backed by Google, Microsoft, Amazon, Visa, and 20+ others — joined the Linux Foundation to build an open standard for AI agent payments
⛏️ MARA Holdings cut roughly 15% of its staff and sold 15,133 BTC for $1.1 billion as bitcoin miners retrench, with Riot Platforms also offloading 3,778 BTC in Q1

Today’s newsletter is brought to you by Nexo!

Unlock Exclusive Rates with Nexo

Rates, product availability, features, and applicable terms may vary based on jurisdiction, eligibility, loyalty tier, and other factors, and are subject to change at any time.

Nexo is a premier digital wealth platform offering:

crypto yield up to 15% (based on stated annual interest rates)
crypto-backed credit lines from 1.9%
a wide range of digital assets.

Join today and get 30-day access to exclusive rates.

North Korea Likely Behind the Largest DeFi Hack of 2026

Drift Protocol, the largest decentralized perps exchange on Solana, lost approximately $285 million in user assets on April 1 in roughly 12 minutes — and blockchain intelligence firms TRM Labs and Elliptic are pointing the finger at North Korean state hackers.

The attack was months in the making. Staging began on March 11 with a withdrawal from Tornado Cash, and attackers spent weeks manufacturing a fictitious token called CarbonVote to manipulate Drift's oracles. The critical move came in late March, when the attacker obtained 2/5 multisig approvals from Security Council members to pre-sign malicious transactions — then executed them all at once on April 1, seizing admin control in minutes.

Omer Goldberg, founder and CEO of Chaos Labs, told Unchained the hack bore a clear signature: "This was very technical, well thought out," he said, adding that the parallels to Bybit were unmistakable — particularly the use of deceptive key signing — but that Drift went further: "They literally controlled the protocol in that moment."

If confirmed as DPRK-linked, this would be Elliptic's eighteenth North Korea-attributed crypto theft of 2026, with over $300 million stolen so far this year.

Check out our interview with Omer Goldberg of Chaos Labs, who broke down exactly what the hackers did — and what makes it so chilling.

Iran War Rhetoric Sends Bitcoin to 2026 Low

The Iran conflict is doing to crypto what it keeps doing to everything: chaos. Bitcoin fell to $65,834 after President Trump announced continued military action against Iran, its lowest price of 2026 and a 3.7% drop in a matter of hours. Ethereum slid 5% and BNB dropped 6.8%, leaving most major tokens in the red for the week.

Trump's primetime address promised to hit Iran "extremely hard" over the next two to three weeks, reversing a short-lived global market rally and sending Brent crude above $106 a barrel.

Markets briefly recovered Thursday when reports surfaced that Iran and Oman were working on a protocol to manage Strait of Hormuz traffic, which pulled oil down about $5 a barrel and helped crypto claw back some losses. Analysts warn, though, that strategic petroleum reserves offsetting Hormuz disruptions could be exhausted within weeks.

Big Tech Lines Up Behind Coinbase's AI Payments Standard

The protocol that lets AI agents pay for things without a human in the loop just got a lot of institutional muscle. The x402 Foundation — formed by Coinbase, Cloudflare, and Stripe to govern an open AI payments standard — is joining the Linux Foundation, bringing along a broad coalition that includes Google, Amazon Web Services, Microsoft, Visa, Mastercard, American Express, Shopify, and roughly a dozen others.

x402 is designed for agentic payments: high-frequency microtransactions that traditional credit card rails can't handle efficiently. It works by embedding stablecoin payments directly into the HTTP 402 "Payment Required" status code, letting apps and AI agents pay for data and services programmatically without billing accounts or invoices.

A rival standard called the Machine Payments Protocol, backed by Stripe, Paradigm, OpenAI, Anthropic, and others, is competing for the same market — and Stripe is notably backing both.

MARA Cuts Staff and Sells Bitcoin as Miners Retrench

Bitcoin miners are shedding both coins and headcount. MARA Holdings conducted company-wide layoffs this week spanning multiple departments, with sources describing the cuts as "ongoing" and executed across at least two rounds. Reports put the figure at roughly 15% of its workforce — approximately 40 positions based on its last disclosed headcount — as the company pivots toward AI and high-performance computing infrastructure.

The layoffs follow MARA's sale of 15,133 BTC for approximately $1.1 billion in March, proceeds used to retire convertible notes at roughly a 9% discount to par.

In another sign of how Bitcoin miners are suffering, Riot Platforms is also trimming its holdings: the miner sold 3,778 BTC in Q1 2026 for $289.5 million at an average price of $76,626, reducing its total reserves to 15,680 BTC — down 18% year-over-year. Riot produced just 1,473 BTC during the quarter, meaning it sold more than twice what it mined.

🔒 X is building an auto-lock feature that triggers identity verification any time an account mentions crypto for the first time, with Head of Product Nikita Bier saying it should "kill 99% of the incentive" behind hijacked account scams targeting high-follower accounts.
⚖️ The CFTC and DOJ filed lawsuits against Illinois, Arizona, and Connecticut after those states sent cease-and-desists to prediction market operators including Kalshi, Polymarket, and Robinhood, arguing the products violate state gambling laws. Arizona had already filed criminal charges against Kalshi.
🟡 Circle announced cirBTC, a wrapped bitcoin token backed 1:1 by native BTC targeting institutional OTC desks, market makers, and lending protocols, launching first on Ethereum and its Arc blockchain — the company's first product beyond stablecoins.
🤫 Tether is making a final push to raise funds at a $500 billion valuation, giving potential investors a two-week deadline to commit, per The Information — this after earlier investor resistance reportedly scaled the round back from $15–20 billion to closer to $5 billion.
⚖️ Trump fired AG Pam Bondi and named Deputy AG Todd Blanche as acting head of the DOJ. Blanche previously dismantled the DOJ's crypto enforcement team and ordered prosecutors to stop pursuing regulatory cases against crypto companies — while holding up to $485,000 in crypto assets at the time.
♾️ Telegram Wallet launched perpetual futures trading with up to 50x leverage via Lighter, bringing leveraged onchain derivatives directly into one of crypto's most-used messaging platforms.
🤖 Bittensor's Subnet 3 completed Covenant-72B, a 72-billion-parameter model trained across 70+ distributed nodes and the first credible proof decentralized AI training can compete with centralized labs, sending top subnet token Templar (SN3) up over 400% in the past month.

🏛️ The OCC granted Coinbase conditional approval to establish a national trust company, positioning it as a federally regulated crypto custodian and replacing its patchwork of state licenses with a single federal framework once final approval is secured.
🏦 SoFi launched Big Business Banking, letting enterprise clients hold deposits and settle transactions 24/7 in fiat or its SoFiUSD stablecoin from a single nationally chartered bank, with launch partners including Cumberland, Fireblocks, Galaxy, and Mastercard.
🌐 The IMF published a new assessment calling tokenization a "structural shift in financial architecture rather than a marginal efficiency improvement."
🇫🇷 French blockchain exchange Lise is preparing to list aerospace supplier ST Group on April 9 in what would be Europe's first fully on-chain IPO under the EU's DLT Pilot Regime, backed by BNP Paribas, Crédit Agricole's CACEIS, and Bpifrance.
📈 Global X launched a new Ethereum covered call ETF targeting weekly income distributions, expanding the options-based crypto ETF market.
💻 Quip.Network launched a quantum-classical blockchain testnet built in consultation with D-Wave, allowing researchers to mine blockchain tasks on a quantum computer for the first time.

🎰 Pump.fun led a $1 million pre-seed round in Pumpcade, a livestream prediction markets platform building at the intersection of gaming and onchain wagering.
🔮 YZi Labs (the CZ-backed fund) made a follow-on investment in Predict.fun, joined by Susquehanna Crypto — a sign of continued institutional appetite for prediction market infrastructure despite the CFTC's ongoing state-level legal battles.

Enter Bitcoin Capital Markets