Drift Protocol Says Attacker Hijacked Admin Powers in $285 Million Solana Exploit

Drift Protocol, a perpetual futures exchange built on Solana, spent April Fools’ Day insisting that its emergency was real. “This is not an April Fools joke,” the team told users on X on Wednesday afternoon, after an attacker drained an estimated $285 million from the platform in a matter of minutes. A day later, Drift has offered its first account of how it happened, and it points not to a coding bug but to the people and processes that control the protocol.

The incident is now the largest decentralized finance hack of 2026 and, according to blockchain analytics firm TRM Labs, the second biggest exploit in Solana’s history, behind only the $326 million Wormhole bridge attack in 2022.

How the drain unfolded

According to Decrypt, the first large transfer left Drift’s vault shortly after 11 a.m. on Wednesday, when roughly 41 million JLP tokens worth about $155 million moved to an attacker address. Users began flagging suspicious activity around midday. Drift did not confirm the attack publicly until about 3 p.m. Eastern, when it said deposits and withdrawals had been suspended and that it was working with security firms, bridges and exchanges to contain the damage.

Estimates of the loss have varied. Drift initially said more than $200 million was affected, while security firm PeckShield put the figure as high as $285 million. Breakdowns shared on-chain show the haul included about $60 million in USDC, about $156 million in JLP, around $11 million in Coinbase’s wrapped bitcoin, and smaller amounts of other tokens. TRM Labs says the withdrawals took roughly 12 minutes.

The DRIFT governance token fell sharply on the news, losing more than a third of its value at one point on Wednesday.

Not a smart contract bug

On Thursday, Drift said the attacker gained unauthorized access through what it called a novel attack involving durable nonces, which led to a rapid takeover of the administrative powers held by its Security Council. Durable nonces are a Solana feature that lets a transaction be signed now and executed later without expiring.

According to Drift’s timeline, as reported by ForkLog, preparations began on March 23, when four wallets with delayed-transaction capability were created. Two were linked to Security Council members. Drift said at least two of the five required signers approved transfers from those wallets, and it suggested the attacker used sophisticated social engineering to obtain those approvals. Following a scheduled rotation of the Council, the attacker set up a wallet for the updated multisig on March 30. On April 1, about a minute after a legitimate test withdrawal, the attacker fired off two pre-signed transactions: one created and approved a malicious transfer of powers, and the other executed it.

TRM Labs adds more detail. It says Drift migrated its Security Council to a new two-of-five multisig with no timelock on March 27, removing a delay that could have given defenders time to react. TRM also says the attacker spent weeks building a fake price history for a token called CVT, minting 750 million units, seeding a few thousand dollars of liquidity and wash trading it near $1. Once in control, the attacker listed CVT as collateral, lifted withdrawal limits, deposited the token at its manufactured value and withdrew real assets against it.

Drift said there was no evidence that seed phrases were compromised. It has frozen remaining functions, updated the multisig and removed the compromised wallet.

North Korea suspected, Circle criticized

TRM’s preliminary view is that North Korean hackers were likely behind the attack. It points to on-chain staging that began in March with a withdrawal from Tornado Cash and to the timing of some transactions relative to Pyongyang working hours. TRM stressed that its attribution is preliminary and that more findings will follow.

Most of the stolen funds were bridged from Solana to Ethereum within hours, in transfers ranging from hundreds of thousands to millions of USDC. That speed drew criticism of Circle, the issuer of USDC, which can freeze its tokens. On-chain investigator ZachXBT and others noted that large USDC sums moved across chains during U.S. business hours without being frozen. As of Thursday, Circle had not publicly acted on the funds.

Why it matters

For crypto readers, the Drift exploit is a reminder that the weakest point in a DeFi protocol is often not its code. The contracts appear to have worked as written. What failed, according to Drift and TRM, was the human layer: signers who approved transactions they did not fully understand, and a governance change that removed a safety delay just days before the attack.

It also lands at a sensitive moment for Solana DeFi, which has been courting institutional users with promises of speed and reliability. Questions about admin keys, timelocks and multisig practices are likely to spread to other protocols as teams review their own setups.

Finally, the episode puts stablecoin issuers in an uncomfortable spotlight. Issuers have the technical power to freeze funds, and users increasingly expect them to use it quickly during live attacks. How Circle responds to the criticism, and whether any of the bridged funds can be recovered, will shape that debate in the coming days.

Drift says it is working with security specialists, exchanges, bridges and law enforcement to trace the stolen assets. Deposits and withdrawals remain suspended.