Drift protocol (DRIFT)

yesterday (April 1, 2026) wasn’t a joke. Drift Protocol one of Solana’s biggest perpetuals DEXes, sitting on hundreds of millions in TVL got drained for an estimated $200–285M in one of the largest on-chain exploits we’ve seen this year. the team suspended deposits and withdrawals immediately and is working with security firms. Funds were moved fast: swapped on Jupiter, bridged to Ethereum, and largely converted to ETH. The DRIFT token got wrecked in the process. but here’s what actually happened, and why this incident is bigger than just another “DeFi hack.” the attack in plain English (the mechanics, not the memes): - the attacker spent weeks preparing: minted ~750 million units of a completely fake token called CarbonVote Token (CVT). - the created a tiny Raydium pool with just $500 in liquidity to manufacture a fake ~$1 price, then wash-traded it to build a believable on-chain price history that oracles would pick up. - using a compromised Drift admin key, they listed CVT as valid collateral on the pr

A wallet linked to the Drift Protocol Team deposited 56.25M $DRIFT worth $2.44M into #Bybit and #Gate since the hack. https://t.co/TYDga9Dhtx https://t.co/lt9rocKTfi

A wallet linked to the Drift Protocol Team deposited 56.25M $DRIFT worth $2.44M into #Bybit and #Gate since the hack. https://t.co/TYDga9Dhtx https://t.co/lt9rocKTfi

A wallet linked to the Drift Protocol Team deposited 56.25M $DRIFT worth $2.44M into #Bybit and #Gate since the hack. https://t.co/TYDga9Dhtx https://t.co/lt9rocKTfi

i can't stop thinking about the drift protocol hack. not because of the $280m. we've seen big numbers before. i can't stop thinking about how it happened. and what it says about everything we're building. on april 1st, while people were posting jokes, an attacker drained $280 million from drift protocol in minutes. the team had to literally tweet "this is not an april fools joke." but this didn't start on april 1st. it started on march 23rd. that's when the attacker created four durable nonce accounts. two tied to drift's own security council multisig members. two controlled by the attacker. quietly. no alarms. no flags. on march 27th, drift migrated their security council due to a routine member change. by march 30th, the attacker had already compromised a signer on the new multisig too. then on april 1st, they executed. a test transaction first. then one minute later, two pre-signed transactions fired four slots apart. admin takeover. withdrawal limits removed. a malicious asset introduced. every vau

I went through Drift’s incident thread, and this is the clearest play by play of what happened to @DriftProtocol ↓ March 23 The setup appears to have started here. Drift says 4 durable nonce accounts were created. That suggests parts of the attack were prepared in advance. Drift’s implication → At least 2 of 5 signer approvals were already tied to the setup March 27 Drift says the Security Council multisig was updated because one council member was replaced. It did not explain why. But the change did not fully remove the attacker’s path. March 30 A new durable nonce account was created for someone in the updated multisig. That suggests the attacker still had effective access to 2 of the 5 required signers. April 1 Drift spotted unusual activity. Users were told not to deposit. Deposits and withdrawals were suspended shortly after. Later that day, Drift says there was a legitimate-looking test withdrawal from the insurance fund. About a minute later, 2 pre-signed durable nonce transactions were ex