Drift Protocol said the attackers posed as traders, met contributors in person, and spent months infiltrating before draining the platform.