Site iconSite icon ForkLog

Drift Protocol on Solana loses $280m

ForkLog
Drift Protocol on Solana loses $280m

On April 1, the DeFi platform Drift Protocol on Solana was hacked. The attacker drained at least $280m.

“We are observing unusual activity and are currently investigating. Please do not deposit any funds into the platform. This is not an April Fools joke. Proceed with caution until further notice,” the team wrote.

Timeline

According to the developers, the hacker prepared the operation for several days. As early as March 23, they created four wallets with a delayed-transaction mechanism (durable nonces). Two were associated with members of Drift’s Security Council, and two were under the attacker’s control.

At least two of five signers approved transfers from these wallets. The developers suggested the attacker used sophisticated social-engineering techniques.

A few days later, the project conducted a scheduled rotation of the Council. In response, on March 30 the hacker created a new wallet for the updated multisig.

The attack took place on April 1. First, the Drift team carried out a legitimate test withdrawal from the insurance fund. About a minute later, the attacker activated two pre-signed transactions. One created and approved a malicious transfer of powers; the second executed it.

Aftermath

The attack affected all deposit types—lending, trading and vaults. DSOL tokens outside the Drift ecosystem and the Insurance Fund’s assets were untouched. For safety, the protocol froze remaining functions, updated the multisig and removed the compromised wallet.

The project is currently working with cybersecurity specialists, cross-chain bridges, exchanges and law enforcement to trace and block the stolen funds.

Among the stolen assets were wrapped versions of bitcoin, Jito tokens, the memecoin Fartcoin, other altcoins, as well as stablecoins pegged to the US dollar, euro and Japanese yen. After the theft the hacker distributed the funds across several wallets.

Following the incident, the protocol’s native coin DRIFT fell by almost 37%—from $0.07 to $0.04. Market capitalisation almost halved—from $41m to $25m.

Source: CoinGecko.

TVL for Drift remains around $245m.

Source: DefiLlama.

Users doubt the project’s prospects for recovery after the hack. The statistics hint at the same: major attacks are considered a “death sentence” for 80% of protocols. The Drift incident will rank among the industry’s largest.

“I think Drift just… dies here? Bybit was able to get a billion-dollar loan immediately after the hack because their yearly revenue justified such sums. Drift doesn’t make enough for any company or bank to comfortably issue a loan to plug a hole like this,” wrote a community member under the nickname Eddie.

Backlash against Circle

Participants in the crypto industry criticised the company behind USDC, Circle, for a slow response to the Drift hack. Delphi Digital co-founder Tommy Shaughnessy said the issuer did not promptly freeze funds linked to the attack.

“Circle not freezing USDC looks absurd. Everyone knows the stablecoin is centralised, but the company seems not to impede the free flow of funds—even to North Korea,” he wrote.

On-chain sleuth ZachXBT voiced a similar view. He stressed that the hacker moved hundreds of millions of dollars from Solana to Ethereum during US business hours and Circle did nothing to stop it.

At the time of writing, the company had still taken no action.

In late March, ZachXBT accused Circle of mistakenly freezing 16 wallets.

Exit mobile version