Avg attacker reconnaissance time for peer-class protocols
Kamino Lend's assessment for RD-F-163 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Peer-class evidence: Drift Protocol 6-month DPRK social engineering before April 2026 exploit; USPD pattern averages ~78 days. Kamino as largest Solana lending protocol is a plausible high-value DPRK target. No Kamino-specific reconnaissance evidence identified.
Detail #
In-sample peer-class evidence: Drift Protocol (Solana DeFi) — UNC4736 conducted 6-month targeted social engineering beginning fall 2025, culminating in $285M exploit April 2026. USPD methodology: 78-day avg recon before strike. Kamino, with ~$1.5B TVL on Solana, is an order-of-magnitude larger target than Drift ($285M exploited vs. Kamino's $1.5B TVL). This does not confirm Kamino reconnaissance is underway; it establishes the peer-class risk level for analytical purposes.
Sources #
- URLDrift DPRK 6-month operationDrift $285M exploit: 6-month UNC4736 social engineering on Solana DeFi — The Hacker News 2026-04retrieved 2026-04-27
Methodology #
Report the average number of days of attacker reconnaissance activity before a strike on peer-class protocols (lending/DEX/bridge/perps), sourced from the hack database.
See the full factor methodology and distribution across all protocols →