US Edition
Here is how Drift attackers drained more than $270 million using a Solana feature designed for convenience
Attackers used durable nonces and pre-signed approvals to seize admin control, drain more than $270 million, and freeze the protocol, researchers said.
- On April 1, an attacker drained $285 million from Drift Protocol, a Solana-based perpetual futures exchange, marking the second-largest exploit in the network's history and highlighting security risks beyond smart contracts.
- The exploit did not involve smart contract bugs; instead, attackers misused a legitimate Solana feature called 'durable nonces' to trick two of five Security Council multisig members into pre-approving malicious transactions.
- Using administrative access, the attacker created a fake token called CarbonVote Token to manipulate price oracles, enabling them to drain over $250 million from Drift's shared liquidity pool.
- Onchain investigator ZachXBT criticized Circle for failing to freeze stolen USDC as the attacker bridged over $230 million to Ethereum via Circle's Cross-Chain Transfer Protocol during U.S. business hours.
- Security experts warn that operational failures, rather than code vulnerabilities, are becoming the primary method for DeFi exploits, as Solana's SOL token fell 5.5% to around $78 following the incident.
38 Articles
38 Articles
Here is how Drift attackers drained more than $270 million using a Solana feature designed for convenience
The exploit did not involve a bug in Drift's code. It used "durable nonces," a legitimate Solana transaction feature, to pre-sign administrative transfers weeks before executing them, bypassing the protocol's multisig security in minutes.
North Korea–linked hackers drain $285M from Drift in sophisticated attack
North Korea–linked hackers drain $285M from Drift in sophisticated attack Pierluigi Paganini April 03, 2026 Drift lost $285M in a sophisticated attack, likely by North Korea, who used nonce-based tricks to gain control and quickly drain funds Drift suffered a $285 million cryptocurrency heist in a highly sophisticated attack likely linked to North Korea. Threat actors used durable nonce accounts to pre-sign and delay transactions…
From Drift to Curio: A Wave of Exploits Reveals DeFi’s Hidden Fragility
Summary: A major Solana-based DeFi protocol suffered a $280M exploit through an advanced administrative attack. The incident triggered market-wide declines […] The post From Drift to Curio: A Wave of Exploits Reveals DeFi’s Hidden Fragility appeared first on CoinsPress.
Coverage Details
Bias Distribution
- 75% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
