Drift Protocol Hack: Durable Nonces, Admin Capture, and the $250M+ Solana Drain

Drift Protocol Hack: Durable Nonces, Admin Capture, and the $250M+ Solana Drain

A forensic reconstruction of how a Solana perpetuals venue appears to have been captured through privileged approvals, delayed execution, and state reconfiguration rather than a generic trading-engine bug.

TL;DR

• The strongest evidence supports an administrative capture, not a public smart contract bug.

• Drift said the attacker used a durable-nonce-based attack to take over Security Council administrative powers.

• The clearest exact artifact is a small pre-attack withdrawal from Drift Vault to the attacker wallet, which looks like rehearsal.

• The CVT theory still fits, but best as a monetization layer after privileged control was already captured.

• The operational lesson is simple: if admin state controls collateral, oracle trust, and withdrawals, admin workflow is part of protocol security.

What Is Actually Confirmed

The public record is noisy, but the core facts are not.

Drift said a malicious actor used a durable-nonce-based attack to gain unauthorized administrative access. That matters because Drift's critical controls are not only in trading logic. They also live in privileged state transitions: collateral admission, oracle configuration, market status, exchange status, and withdrawal guards.

If that admin path is captured, the attacker does not need to bypass the system. They can change what the system trusts.

The Durable Nonce Angle

Durable nonces are not the bug. They are the scheduling layer that made the attack harder to detect.

Normal Solana transactions expire quickly because they rely on recent blockhashes. Durable nonce transactions can be signed earlier and executed later. In a governance or council workflow, that means the approval moment and the execution moment can be separated by days or weeks.

Attack Breakdown

The most defensible reconstruction is not complicated.

The clearest early proof: a rehearsal withdrawal

The strongest exact artifact recovered in this investigation is transaction:

5brWcBQk4iYGH1YuaA4JYS6QhedA9itA2MDaJixqrhQe9Pk6mzpt2N68Ne5a2nqrgHmg5AxN4RMPH3paqX5jSM8a

Solscan labels it as a withdrawal from Drift Vault JCNCMFXo5M5qwUPg2Utu1u6YWp3MbygxqBsBeXXJfrw to Drift Exploiter 1 HkGz4KmoZ7Zmk7HN6ndJ31UJ1qZ2qgwQxgVqQwovpZES.

The amount was only 0.03000003 WSOL, but that is exactly why it matters. It reads like a test of the extraction path before the main drain.

Why admin capture mattered more than any single downstream trick

Once privileged execution is lost, multiple safety layers become exploitable at once.

This is why "admin takeover" is the main story. Oracle abuse or fake collateral may have been part of monetization, but they are downstream once the attacker can change trusted state.

Where the CVT theory fits

r0bre's three-transaction claim is still useful:

1. create a Drift user account

2. deposit 500 million CVT as collateral

3. withdraw real assets against that collateral

That is a plausible monetization path because Drift's cross-collateral model explicitly turns approved deposits into usable margin according to policy. But the CVT story does not explain the root cause by itself. The more important question is how the protocol could have been made to trust that asset in the first place.

The best current answer is privileged reconfiguration after admin compromise.

Evidence Map

Fund Flow

The exit path is less disputed than the setup.

ZachXBT's main contribution here is containment analysis. The key operational criticism is that funds were still moving in size during U.S. business hours without fast enough intervention across the bridge and issuer surface.

Timeline

Root Cause and Lessons

The root cause was privileged-state compromise.

That phrasing is more useful than "oracle exploit" and more precise than "admin key leak." Drift's published design makes collateral policy, oracle trust, and withdrawal safety dependent on trusted administration. Once that administration is captured, monetization paths multiply.

Three lessons follow:

1. Multisig thresholds are not enough if signers can approve opaque or delayed payloads.

2. Governance safety is protocol safety when admin state controls borrow power and withdrawals.

3. Durable nonce workflows need visibility and alerting, not just permissioning.

{
  "title": "🎬 Admin capture to drain, and how a timelock breaks it",
  "stage": { "width": 920, "height": 440 },
  "nodes": [
    { "id": "attacker", "label": "Attacker", "role": "captures admin", "emoji": "🧑‍💻", "x": 60, "y": 200, "color": "red" },
    { "id": "council", "label": "Security Council", "role": "admin powers", "emoji": "🛡️", "x": 430, "y": 60, "color": "cyan" },
    { "id": "vault", "label": "Drift Vault", "role": "collateral control", "emoji": "🏦", "x": 430, "y": 330, "color": "gold" },
    { "id": "exit", "label": "Exit route", "role": "swaps → CCTP → ETH", "emoji": "🌉", "x": 760, "y": 200, "color": "purple" }
  ],
  "links": [
    { "from": "attacker", "to": "council" },
    { "from": "council", "to": "vault" },
    { "from": "vault", "to": "attacker" },
    { "from": "attacker", "to": "exit" }
  ],
  "nets": [
    { "id": "vault", "label": "Vault value" },
    { "id": "atk", "label": "Attacker (off-route)" }
  ],
  "legend": [
    { "cls": "call", "label": "admin instruction" },
    { "cls": "token", "label": "asset movement" },
    { "cls": "sig", "label": "trust / state change" },
    { "cls": "fail", "label": "delayed / blocked" }
  ],
  "scenarios": {
    "What appears to have happened": [
      { "note": "Collateral policy, oracle trust, and withdrawals depend on <b>trusted administration</b> by the Security Council.", "hi": ["council","vault"], "bal": { "vault": "collateral intact", "council": "trusted" }, "net": { "vault": "$250M+", "atk": "$0" } },
      { "note": "The attacker captures Security Council admin powers through the reported durable-nonce takeover.", "tone": "bad", "hi": ["attacker","council"], "chip": { "from": "attacker", "to": "council", "label": "capture admin", "cls": "sig" }, "bal": { "council": "attacker-controlled" } },
      { "note": "With <b>durable nonces</b>, signed admin instructions stay executable until the attacker's chosen window.", "tone": "bad", "hi": ["council","vault"], "chip": { "from": "council", "to": "vault", "label": "durable-nonce admin tx", "cls": "call" } },
      { "note": "A tiny rehearsal withdrawal (<b>0.03 WSOL</b>) tests the extraction path from the vault to the attacker.", "tone": "bad", "hi": ["vault","attacker"], "chip": { "from": "vault", "to": "attacker", "label": "rehearsal: 0.03 WSOL", "cls": "token" } },
      { "note": "Once policy is attacker-friendly, the real vault assets become reachable and are drained.", "tone": "bad", "hi": ["vault","attacker"], "chip": { "from": "vault", "to": "attacker", "label": "drain $250M+", "cls": "token" }, "bal": { "vault": "drained", "attacker": "+$250M+" }, "net": { "vault": "$0", "atk": "+$250M+" } },
      { "note": "Funds are swapped on Solana, concentrated to USDC, and bridged out through CCTP before containment catches up.", "tone": "bad", "hi": ["attacker","exit"], "chip": { "from": "attacker", "to": "exit", "label": "swap → CCTP → ETH", "cls": "token" } }
    ],
    "Fixed (timelock + guardian)": [
      { "note": "The same design routes admin instructions through a <b>timelock</b> with monitoring.", "hi": ["council","vault"], "bal": { "vault": "collateral intact", "council": "timelocked" }, "net": { "vault": "$250M+", "atk": "$0" } },
      { "note": "Even if signer trust is compromised, the captured admin powers can no longer act instantly.", "tone": "ok", "hi": ["attacker","council"], "chip": { "from": "attacker", "to": "council", "label": "capture admin", "cls": "sig" } },
      { "note": "The staged durable-nonce admin tx hits a <b>timelock delay</b>, queues publicly, and triggers monitoring.", "tone": "ok", "hi": ["council","vault"], "chip": { "from": "council", "to": "vault", "label": "⏳ queued (timelock)", "cls": "fail" } },
      { "note": "During the delay, a guardian or pause path revokes the malicious change before reconfiguration lands.", "tone": "ok", "hi": ["council"], "chip": { "from": "council", "to": "council", "label": "guardian revokes", "cls": "sig" } },
      { "note": "Collateral, oracle trust, and withdrawals stay under honest policy. The vault is never made drainable.", "tone": "ok", "hi": ["vault"], "bal": { "vault": "collateral intact" }, "net": { "vault": "$250M+", "atk": "$0" } }
    ]
  }
}

Conclusion

The cleanest summary is this: the attacker does not appear to have broken Drift's math first. The attacker appears to have gained the right to tell Drift what to trust.

That distinction matters. It moves the incident out of the narrow category of trading-engine bugs and into the much larger category of governance, signer, and privileged-workflow failure.

Further study:

• Smart Contract Hacking course syllabus

• Course pricing and enrollment

Appendix: Confirmed Facts, Disputed Claims, and Unknowns

Confirmed Facts

• Drift said the attacker gained unauthorized access through a durable-nonce-based takeover of administrative powers.

• The attacker wallet was HkGz4KmoZ7Zmk7HN6ndJ31UJ1qZ2qgwQxgVqQwovpZES.

• A labeled Drift Vault account sent a small exact WSOL withdrawal to that wallet before the larger drain.

• More than $250 million appears to have been lost.

• Post-exploit routing moved through Solana swaps and Circle CCTP toward Ethereum.

Disputed or Partially Verified Claims

• The precise CVT mint and its exact role in the monetization path.

• The exact number of compromised or deceived signers.

• The full list and order of admin-level instructions executed after compromise.

• The final ETH balance attributed to the exploiter.

Unknowns That Still Matter

• Which exact signer workflow failed.

• Whether the approvals were maliciously disguised, device-compromised, or both.

• Whether any off-chain coordination or infrastructure compromise preceded the nonce phase.

Appendix: Sources

• Drift Protocol official statement
• ZachXBT on CCTP routing and response
• Only1temmy thread
• r0bre thread
• Omer Goldberg thread
• Lookonchain post-drain flow claim
• ArxsTV thread
• Decrypt reporting
• Drift protocol overview
• Drift cross-collateral deposits
• Drift oracle documentation
• Drift guard rails
• Solana durable nonce documentation
• Solscan pre-attack withdraw
• Solscan exploiter wallet
• Solscan Drift Vault