Ledger CTO: The Drift attack method is identical to the hacking incident at a certain exchange, and the attacker may be a North Korean hacker

Ledger CTO Charles Guillemet stated that the attack method used in the recent Drift Protocol exploit was identical to a 2025 exchange hacking incident, which was widely believed to be linked to North Korean hackers.

Guillemet pointed out that the attack did not target any smart contract; instead, the attackers infiltrated multi-signature signers' devices over the long term, tricking them into approving malicious transactions. The signers may have always believed they were authorizing legitimate operations. He emphasized that the root issue lay in security shortcomings at the personnel and operational levels, rather than in the code itself.