What happened
On April 1, 2026, Drift Protocol on Solana suffered a coordinated privileged-access compromise. Drift confirmed that more than $280 million was withdrawn; Chainalysis assessed the incident at approximately $285 million.
The attack compromised privileged governance rather than exploiting a reported core-contract bug. Durable nonce transactions kept social-engineered approvals executable long enough to transfer Security Council administrative authority.
How it happened
Attackers socially engineered Security Council members into pre-signing durable-nonce transactions, used those transactions to take administrative control, admitted a falsely priced token as collateral, and withdrew real assets.
Protocol details
Security review history
- Zellic View report
Evidence
- report Drift Protocol incident statement x.com
- report @CertiKAlert incident report x.com
- report @PeckShieldAlert incident report x.com
- report Post-mortem rekt.news
- report @PeckShieldAlert incident report x.com
- analysis DeFiLlama defillama.com
- analysis Chainalysis: Lessons from the Drift hack chainalysis.com
- analysis The Record: Drift confirms $280 million withdrawn in a security incident therecord.media
- analysis Drift: Incident Recovery Update drift.trade
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
