Drift v1 Accounting Incident
Theft not established
Not disclosed
Profit withdrawal accounting failure
What happened
Drift paused its v1 exchange on May 11, 2022 after LUNA volatility exposed withdrawal and profit-accounting problems. Its report states there was no proof of a malicious attacker. Approximately $14.5 million in financing covered the settlement shortfall; this was not a documented attacker payout.
Technical root cause
Profit withdrawals lacked offsetting-loss checks and market isolation, while leverage did not adjust adequately to long-short imbalance.
How it happened
- Users could realize and withdraw profits before matching losses were realized.
- Withdrawals accessed shared Insurance Fund balances, spreading market risk.
- Unchecked leverage amplified the imbalance.
- Drift paused trading, settled positions and financed the shortfall.
Protocol details
Classification
Protocol Logic / Accounting and Solvency Incident
Protocol Type
Derivatives
Implementation language
Rust
Protocol links
Website
@DriftProtocol
Security review history
- Zellic View report
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
