Drift Protocol loses about $280 million in Solana governance takeover

On 1 April 2026, Drift Protocol, a decentralised exchange for perpetual futures built on the Solana blockchain, was drained of roughly $280 million, more than half of the value locked in the platform. Drift said a malicious actor had gained unauthorised access "through a novel attack involving durable nonces, resulting in a rapid takeover of Drift's Security Council administrative powers." The company suspended deposits and withdrawals while it investigated.

How the attack worked

The theft did not rely on a smart contract bug or oracle manipulation. Solana's durable nonce feature lets transactions be signed in advance and submitted later. The attacker used it to get Security Council members to pre-approve transactions that were executed weeks afterwards, giving the intruder administrative control of the protocol. Funds were then pulled out of several Drift vaults within minutes.

Post-incident analyses describe a months-long social-engineering operation in which the attackers built trust with key stakeholders and multisig signers before obtaining valid approvals on malicious transactions. The stolen assets were then spread across many wallets and bridged to other blockchains. Blockchain analytics firm Elliptic said the on-chain behaviour matched earlier thefts attributed to North Korea, which stole about $2 billion in cryptocurrency in 2025.

Why it matters

Drift had more than $400 million in deposits at the time, and the loss was one of the largest crypto thefts since the $1.5 billion Bybit heist in 2025. It was followed weeks later by the $292 million Kelp DAO bridge exploit, also blamed on North Korea. Both cases show attackers targeting the people and off-chain processes that control DeFi protocols rather than the code itself.