Decentralized finance company Drift says it has suspended withdrawals and deposits after confirming a security incident. 

The crypto platform said in a post on X that it was “experiencing an active attack,” and that it was working to “contain the incident.”

Security researchers and public blockchain data suggest the losses could be significant. Blockchain security firm CertiK said on X that hackers may have stolen around $136 million, while crypto analytics firm Arkham put the figure at around $285 million stolen.

If confirmed, this would make the Drift hack the largest crypto theft of the year, according to the Rekt leaderboard, a site that tracks crypto thefts by size.

It’s not clear who is behind the attack, and a spokesperson for Drift did not immediately respond to a request for comment.

Security firms say North Korea was behind the most crypto thefts last year, netting at least $2 billion in stolen cryptocurrency, funds the regime is believed to use to finance its nuclear weapons program and skirt international sanctions that restrict its access to the global financial system.