GM, Welcome Back to the Dead Drop.

Last week we opened the Pardon Ledger and followed the money that a presidential pen had quietly erased, $1.3 billion in court-ordered restitution wiped from the books while the administration's new fraud task force trained its sights on food stamp recipients in Minnesota. Today we're going somewhere colder and considerably more patient.

This week, a nation of 26 million people with no functional economy and a nuclear weapons program to finance stole $285 million from the crypto markets in 12 minutes. They had been preparing for six months. The people they robbed had shaken their hands, answered their questions, and shared drinks with them at conferences on three continents.

We fear the man who threatens us because he is visible, and the visible can be defended against. We do not fear the man who has studied our unacknowledged needs, our shadow hungers, the things we want but cannot say aloud, because he does not appear as a threat at all. He appears as an answer. That is the oldest predation there is.

Understand something before we go further. You are not a bystander in this conflict. Modern hybrid warfare does not distinguish between soldier and civilian, because the weapon of choice is not a rifle, it is your trust, your data, your digital identity, your financial infrastructure. The bombs in this war are 1s and 0s, and they land in living rooms, in retirement accounts, in the pocket of every person who answered a text message from someone they thought they knew.

You have to understand what North Korea's cyber operation actually is before you can understand what happened to Drift Protocol on April 1, 2026, because if you think of it as hacking, you will misread everything that follows.

The Reconnaissance General Bureau, which oversees the DPRK's offensive cyber units, runs what amounts to a state-owned financial services conglomerate, except that the services it provides are wire fraud, supply chain compromise, social engineering, and cryptocurrency theft, and the customers are the regime's missile engineers and nuclear scientists. Lazarus Group generates revenue. Kimsuky collects intelligence. Andariel delivers disruption. These are not rogue actors. They are departments. They have budgets, quotas, and operational tempos. In 2025, they stole a record $2 billion in cryptocurrency, $1.46 billion of it from the Bybit exchange in a single operation. The U.S. Treasury has formally linked these proceeds to North Korea's weapons of mass destruction program, which means that every dollar drained from a DeFi protocol in San Francisco or Singapore lands, eventually, in the calculation behind a ballistic missile.

UNC4736, the unit that hit Drift, also goes by AppleJeus, Citrine Sleet, Golden Chollima, and Gleaming Pisces, and if the multiplicity of names feels like overkill, understand that intelligence and cybersecurity firms track the same actors under different designations because they keep catching glimpses of the same thing from different angles. CrowdStrike describes this unit as geared toward baseline revenue generation, the operational tempo of a treasury department, not a special forces team. They hit smaller targets more frequently. Drift was not a small target, and what they did to it was not fast.

Sometime in the fall of 2025, representatives of what appeared to be a quantitative trading firm began approaching contributors to the Drift Protocol at major cryptocurrency conferences. The exact conferences, the exact cities, have not been publicly disclosed, but Drift's own postmortem describes meetings in multiple countries over multiple months. These were not anonymous messages from a Telegram handle. These were people who showed up in person, who were technically fluent, who knew how Drift operated, who asked the kind of informed product questions that only someone who had done serious homework would ask.

They were not North Korean nationals. Drift said this explicitly. The DPRK deploys third-party intermediaries for face-to-face relationship building, which means somewhere in this chain there are people who are either witting assets or simply very convincingly recruited talent who had no idea what the back end of the operation looked like. The operatives who shook hands with Drift contributors at those conferences were human shields for the actual architects, who were sitting in Pyongyang running the timeline.

Between December 2025 and January 2026, the trading firm onboarded an Ecosystem Vault on Drift. They filled out the forms. They participated in working sessions. They deposited more than $1 million of their own capital into the protocol. Through February and March 2026, contributors met members of the group face-to-face at additional industry events. By the time April arrived, these were not strangers. They were partners with a nearly six-month-old working relationship, proven skin in the game, and access to internal conversations about how the protocol's administrative architecture was structured.

The $1 million deposit was not a cost. It was an investment in the credibility required to steal 285 times that amount.

This is where most coverage stops and where this newsletter will not, because what North Korea built inside Drift was not primarily a technical exploit. It was a psychological infrastructure, and the components are recognizable to anyone who has studied how human beings make trust decisions under conditions of incomplete information.

Reciprocity. When the trading firm deposited $1 million into Drift's ecosystem, they created an obligation. In the cognitive economy of a working relationship, a counterparty who puts real money into your protocol is not a threat. They have demonstrated commitment. They have something to lose. Every dollar of that deposit was quietly purchasing the assumption of shared interest.

Social proof and authority. They were not anonymous. They appeared at conferences where the people of this industry gather, which meant the industry itself was implicitly vouching for their presence. They were technically fluent. They spoke the language correctly, asked the right questions, referenced the right mechanisms. In a domain where most newcomers reveal themselves through their ignorance, fluency functions as a credential.

Liking and rapport. Telegram channels were established. Conversations about trading strategies and vault integrations ran for months. The human brain is not designed to sustain suspicion across six months of substantive, friendly, technically coherent conversation. It is designed to reduce cognitive load by filing familiar contacts into the trusted category and leaving them there. By February, the mental model of the trading firm as a legitimate partner was not a hypothesis. It was settled fact.

Commitment and consistency. Once Drift contributors had integrated the trading firm into their workflow, the cognitive cost of reversing that integration became real. They had approved the Ecosystem Vault onboarding. They had answered questions, shared documentation, met in person. Abandoning a six-month partnership requires a specific trigger, a specific reason to feel alarm. The operatives gave them none.

Then, at some point between December 2025 and February 2026, one contributor cloned a code repository the trading firm had shared, ostensibly as a frontend deployment tool for their vault. The security community had been flagging a critical vulnerability in VS Code and Cursor since late 2025: simply opening a folder was sufficient to silently execute arbitrary code. No prompt. No permission dialog. No warning. Another contributor was persuaded to download a wallet application through Apple's TestFlight for beta testing. The devices were compromised quietly, over weeks, while the conversations continued.

On April 1, 2026, using a technique called a durable nonce attack that allowed transactions to be pre-signed and delayed in execution, the attackers triggered the drain. The major vaults were emptied in 10 seconds. Within 12 minutes, $285 million in user assets had left the protocol. Most of it was bridged to Ethereum within hours, moving through laundering patterns, including Tornado Cash, that forensic firms at TRM Labs and Elliptic have now documented across multiple prior DPRK operations. The Telegram chats were scrubbed. The malware was deleted. The trading firm ceased to exist.

If confirmed, this is the eighteenth DPRK crypto operation tracked by Elliptic in 2026 alone, with more than $300 million stolen before April ended.

The Drift hack is not only a story about a DeFi protocol. It is a precise, observable case study in how sophisticated adversaries compromise targets who believe they are secure. Every element of this operation scales down to the individual and organizational level.

The long-horizon threat. Your organization's standard security review period is 30 days. North Korea's patience is measured in quarters. Any counterparty who is building a relationship with your team over months, gaining progressively deeper access to internal systems, documentation, or architecture, deserves periodic re-evaluation regardless of how comfortable the relationship feels. Familiarity is not evidence of safety.

The trust-purchase maneuver. When a counterparty makes a financial commitment to your organization early in a relationship, that commitment creates a cognitive anchor. Treat financial skin-in-the-game as a data point, not a clearance. Bad actors account for the cost of building trust.

The development environment as attack surface. The VS Code and Cursor vulnerability that allowed silent code execution upon opening a folder had been publicly documented for weeks before this attack. It was not a zero-day. It was a known, unfixed vulnerability that Drift contributors were apparently unaware of. Every developer on your team needs a protocol for handling code repositories from external parties: sandboxed environments, security review before local execution, and explicit policies about TestFlight or other beta distribution channels for applications related to financial infrastructure.

Multisig hygiene. The drain was ultimately enabled by multisig approvals obtained through compromised devices. Every co-signer on a multisig arrangement should have an independent, air-gapped process for verifying the full content of any transaction before signing, separate from the device that received the request.

The deletion tells you everything. When a counterparty scrubs their communications the moment a breach occurs, that is not coincidence. It is forensic tradecraft. Organizations should maintain independent logs of all substantive external communications and flag any sudden disappearance of a counterparty's digital footprint as an incident requiring immediate investigation.

Deepfakes are forging your face, your voice, and your consent. While you debate which party is lying less, economic policy is looting your purchasing power in broad daylight. The threat doesn't always wear a ski mask; sometimes it wears a suit, a badge, or a campaign pin.

The Dead Drop is the fraud intelligence briefing 6,300+ professionals use to stay informed on fraud, power, and persuasion. Spot the threat before it sees you.

The criminals are already reading this. Your friends should be, too.

Week 2 of a continuing record.

Since last week's issue, new data has surfaced that updates the ledger and deserves its own entry.

A House Judiciary Committee Democratic staff report has documented that at least 33 individuals pardoned by President Trump have gone on to commit new crimes since receiving clemency. The cases range from drug distribution to child exploitation charges to a plot to assassinate law enforcement officers. Jason Galanis, whom we covered last week, defrauded the Oglala Sioux Nation of $60 million and then ran a second Ponzi scheme with the ink still wet on his commutation. He is now serving 37 years for the sequel. He is the face of the argument. He is not the only face.

The California Governor's office has also revised the financial penalty total upward. When forfeitures and criminal fines are added to the restitution figures, the combined financial consequences erased by President Trump's clemency actions approach $2 billion, not the $1.3 billion in court-ordered restitution this newsletter reported last week. The $1.3 billion figure remains accurate for restitution alone. The broader number, the full accounting of what the criminal justice system determined these individuals owed, is higher.

One additional entry deserves a moment.

Henry Cuellar, former Democratic congressman from Texas, was indicted in 2024 on bribery charges. His federal trial was scheduled for this month, April 2026. Trump pardoned him in December 2025, before the trial could begin, before a jury could hear the evidence, before the public record was made. The pardon did not follow an acquittal. It preceded the proceeding entirely. There was no verdict to question and no prosecution to critique as overreach. There was an indictment, a trial date, and then a signature.

The Pardon Ledger will be updated as new clemency actions are issued.

Running confirmed total of erased restitution: ~$1.34 billion, with the broader total of restitution plus forfeitures and fines approaching $2 billion.

North Korea is not just a cybersecurity problem. It is a revenue problem with a nuclear program attached, and the solution its regime chose was to build the world's most patient, most methodologically sophisticated financial crime operation and point it at an industry that values speed and trust and is structurally resistant to the kind of slow, costly verification that would catch what Pyongyang is actually doing.

The Drift operation succeeded not because the people who ran it were smarter than the people they targeted. It succeeded because six months of patient human relationship-building disabled the instincts that might otherwise have caught the attack. They bought their way into trust, built their way into access, and then pulled a trigger that had been installed months before anyone felt the floor move.

Meanwhile, 33 people who received presidential pardons for serious financial crimes have committed new ones, a trial for a sitting congressman on bribery charges evaporated before the jury was empaneled, and the total financial penalties wiped by the clemency pen is approaching $2 billion.

The criminals who funded a weapons program with your neighbors' retirement savings operated out of Pyongyang and introduced themselves at a conference.

The criminals who erased $2 billion in victim restitution operate out of Washington D.C. and signed their names.