North Korean hackers drained $285 million from a Solana exchange in 12 minutes using a fake token worth $700 in real liquidity. Meanwhile, someone built a tiny fish-themed LLM to show you exactly how language models work. And the guy who created PowerShell just called out Microsoft for shipping 17 GUI frameworks in 14 years. Here’s what happened.
In this edition:
- Drift Protocol: $285M drained in 12 minutes by North Korean hackers
- GuppyLM: a 9M-parameter LLM that teaches you how AI works
- Jeffrey Snover: Microsoft hasn’t had a coherent GUI strategy since 1988
- Drama: 4 users on a $29/mo plan consumed 60% of server costs
- First Dollar: a designer ships the project management tool of her dreams
TOP STORIES
TWELVE MINUTES, $285 MILLION
North Korean hackers drained $285M from Solana’s Drift Protocol using a fake token and governance hijack
On April 1, attackers created a fake token (CarbonVote Token), listed it on Drift, inflated its price through a $700 liquidity pool, and used it as “collateral” worth $785M. They hijacked the Security Council’s admin powers, removed withdrawal limits, and drained $285M in 12 minutes. TVL dropped from $550M to $252M overnight.
The details:
- $285M stolen, crypto’s biggest hack of 2026
- Fake token had $700 real liquidity but $785M artificial value
- Used durable nonces to hijack Drift’s Security Council
- TRM Labs: “likely perpetrated by North Korean hackers”
- Bloomberg, Fortune, and PYMNTS all covered it
Why builders care: A fake token, $700 in liquidity, and 12 minutes. Your admin controls are only as strong as your weakest governance check.
Work from any WiFi like it's your home network. NordVPN's Meshnet runs a free private mesh between your laptop, dev box, and home server. SSH from a café without exposing a port, the way you'd use Tailscale. The paid VPN on top lets you test geo-fenced Stripe checkouts or feature flags from any country.
We get a cut if you sign up. Only added for tools we use ourselves.
THE FISH THAT EXPLAINS AI
GuppyLM: a 9-million parameter LLM that talks like a fish and shows you exactly how language models work
Arman BD built GuppyLM, a 9M-parameter language model that pretends to be a fish named Guppy. It shows you every piece of the pipeline: raw text to trained weights to generated output.
The personality is baked into the weights. Multi-turn conversations degrade at turn 3-4 due to a 128-token context window. All of these limitations are the point. You see exactly where it struggles and why.
The details:
- 9M parameters, vanilla transformer architecture
- 128-token context window (intentionally tiny)
- Full code: config, model, dataset, training loop, inference
- 547 HN points, 60 comments
- Pre-trained model on HuggingFace
Why builders care: Big models feel like magic. This one doesn’t. If you want to understand transformers without reading 50 papers, study something small enough to see every moving part.
SEVENTEEN GUI FRAMEWORKS, ZERO STRATEGY
Jeffrey Snover (PowerShell creator) says Microsoft hasn’t had a coherent GUI strategy since 1988
Jeffrey Snover, PowerShell creator, called Microsoft’s GUI situation a “boof-a-rama.” In 1988, Petzold published “Programming Windows” and there was one answer: Win16 API in C. That was the last time Microsoft had a coherent way to build a Windows app.
Today: 17 GUI technologies, 5 programming languages. When asked “what framework for a new desktop app?”, answers ranged from WPF to Electron. The meeting went sideways. The question was never answered.
The details:
- 14 pivots in 14 years on recommended GUI frameworks
- Technologies killed by “internal politics and confusing business strategies”
- 518 HN points, 336 comments
- Published after Snover retired from Microsoft
Why builders care: If you’re building desktop apps for Windows, there’s no “right” answer. Pick a framework, commit, and accept Microsoft will probably pivot again before your app ships.
TRENDING TODAY
“SaaS is not dying.” A post on r/SaaS argues that 99% of people won’t build their own tools, even with AI. “People cling to brands, convenience, and community.” The counter: there’s more competition, but it’s mostly low quality. If anything, AI is expanding the market for well-built SaaS.
Age verification is building a surveillance machine. Half of US states now mandate age verification. These laws link your real identity to every site you visit. Discord already leaked 70,000 ID photos. Starting January 2027, new iPhones sold in California will classify users by age at setup. 118 HN points. Read the analysis.
Apple patches DarkSword exploit across more devices. iOS 18.7.7 now protects iPhone 11 through iPhone 16 against DarkSword, a 6-vulnerability exploit chain that compromises devices just by visiting a malicious website. Linked to Turkish and Russian surveillance vendors. Apple backported the patches to older iOS versions, which they rarely do.
DRAMA
THE UNLIMITED PLAN TRAP
4 users on a $29/mo “unlimited” plan consumed 60% of a SaaS company’s server costs
“$29/mo. Unlimited projects. Unlimited storage. Unlimited API calls.” Then 4 users discovered exactly how unlimited they meant. One ran 14,000 API calls/day. Another uploaded 800GB. Four users paying $116/month consumed $1,400/month in infrastructure.
Why builders care: If you offer “unlimited” anything, someone will test what that means. Price for behavior, not features.
FIRST DOLLAR
DESIGNER SHIPS HER DREAM PROJECT MANAGEMENT TOOL
A designer on r/SideProject shipped Planora, the PM tool she’s been running locally at her game dev job. Built it for herself, finally turned it into a product. It’s free. “I’m so proud of it I can barely sleep.” No funding. Just a designer who scratched her own itch.
STACK OF THE DAY
Parlor - On-device real-time AI with voice and vision. Talk, show your camera, it talks back. All local. Built with Gemma 4 E2B for understanding and Kokoro TTS for speech. Runs on an M3 Pro. No cloud, no API keys, no costs. Built for language learning but works for any voice-based AI interaction. 112 HN points.
Not sponsored. We just feature tools builders would actually use.
BOOKMARKED TODAY
📖 Music for Programming (219 HN points, 95 comments) - Curated mixes of music designed to help you focus while coding. Been around for years, just hit HN again. If you’re tired of lo-fi beats, try these.
📖 Contrapunk: real-time counterpoint harmony from guitar (112 HN points, 49 comments) - Play guitar, get Bach-style harmonies generated in real time. A Show HN that made musicians and programmers both happy.
📖 Gemma Gem: AI model in a browser, no API keys (91 HN points) - Google’s Gemma running entirely in your browser via WebGPU. No cloud. No keys. Just open a webpage and chat with an LLM.
Curated by AI, built by a human. Get this daily: indiehacker.news | X | Telegram