The Drift Hack drained $285M from Solana's largest DEX in under 12 minutes, marking one of crypto's fastest protocol exploits.

$285M Drift Hack: How North Korea Drained Solanas Top DEX

by
Key Takeaways

  • Drift Protocol, Solana’s largest perpetual futures DEX, lost $285M in 12 minutes through 31 withdrawal transactions
  • The attacker combined a fabricated token (CVT), durable nonce abuse, and multisig social engineering over a three-week preparation window
  • TRM Labs and Elliptic both point to North Korean hackers, marking the 18th DPRK-attributed attack of 2026

$285 million in 12 minutes. That is how fast an attacker emptied Drift Protocol, Solana’s largest decentralized perpetual futures exchange, on April 1, 2026. The Drift hack now ranks as the second-largest security breach in Solana’s history, trailing only the $326 million Wormhole bridge exploit of 2022.

The key here is that this was not a simple smart-contract vulnerability. The attacker orchestrated three distinct attack vectors over three weeks: a fabricated token designed to fool Drift’s price oracles, the abuse of Solana’s durable nonce feature to keep pre-signed transactions valid for over a week, and social engineering of Drift’s Security Council multisig. Blockchain intelligence firms TRM Labs and Elliptic independently flagged North Korean hackers as the likely perpetrators.

What makes this incident especially alarming is the level of coordination involved. On-chain staging began on March 11 with a 10 ETH withdrawal from Tornado Cash, and the attack infrastructure was meticulously built over the following 21 days. By the time the exploit executed on April Fool’s Day, Drift’s defenses had already been dismantled from within.

12 Minutes, $285 Million Gone

On April 1, the attacker struck Drift Protocol’s core vaults simultaneously. Thirty-one withdrawal transactions executed in rapid succession over just 12 minutes, draining assets from multiple vault types across the platform. The JLP Delta Neutral vault alone lost approximately 41.7 million JLP tokens, worth roughly $155 million.

The SOL and BTC Super Staking vaults were also hit, with more than 15 distinct token types siphoned from the protocol. In short, the attacker did not target a single pool or exploit a single contract. The entire vault infrastructure was compromised at the administrative level, allowing a coordinated withdrawal that bypassed standard security controls.

Drift’s total value locked collapsed from $550 million to approximately $230 million within an hour. That represents a loss of more than half the protocol’s deposited assets in less time than it takes to watch a single episode of television. The speed and scale of the drain placed this Drift hack squarely behind only the 2022 Wormhole bridge incident in Solana’s exploit history.

AI illustration depicting the Drift hack digital vault breach
The Drift Protocol exploit drained $285M in 12 minutes, ranking as Solana’s second-largest security breach ever – Generated by OpenAI DALL-E 3
Key point: 12 minutes, 31 transactions, $285M drained. The JLP vault alone lost $155M, and Drift’s TVL fell by more than half within an hour.

The CarbonVote Token Trap

The first pillar of the attack was a completely fabricated asset. The attacker minted 750 million units of a token called CarbonVote Token (CVT) at a cost of just a few thousand dollars. Through wash trading, the attacker inflated CVT’s price to approximately $1, creating the illusion of a legitimate asset with meaningful market value.

Drift’s oracle system, which feeds price data to the protocol’s lending and borrowing markets, treated CVT as valid collateral. Put simply, a token manufactured for a few thousand dollars was accepted as collateral worth hundreds of millions. This enabled the attacker to borrow vast quantities of legitimate cryptocurrencies against what was effectively worthless collateral.

PeckShield researcher Xuxian Jiang described the mechanism: the attacker “likely exploited a new market on Drift that lets users borrow other cryptocurrencies against an illiquid token called CVT.” The oracle manipulation was the entry point, but it required the other two attack vectors to reach the scale of $285 million. Without administrative control over the protocol, the borrowing limits and safety parameters would have constrained the damage.

In simpler terms: Imagine walking into a bank with a forged check and asking for a loan against it. The bank’s automated system recognizes the check as genuine, approves the loan, and hands over real money. That is essentially what happened here, except the “bank” was a DeFi protocol and the “check” was a worthless token.

Durable Nonces: A Convenience Feature Turned Weapon

The second pillar exploited a legitimate Solana blockchain feature called durable nonces. Standard Solana transactions expire within a short window if not submitted to the network, but durable nonces override this expiration, allowing pre-signed transactions to remain valid for more than a week.

Between March 23 and March 30, the attacker created multiple durable nonce accounts, effectively pre-loading the exploit transactions well before execution day. The transactions sat dormant for days, invisible to Drift’s monitoring systems, waiting to be triggered at the optimal moment.

The takeaway: the attacker built a set of time bombs that could be detonated at will. When April 1 arrived, the pre-signed transactions were already queued and ready, requiring only a trigger to execute.

The entire drain completed before anyone could react, and this is what made the 12-minute timeline possible. The technical groundwork had been laid over the preceding week, turning execution day into a mechanical process rather than a real-time improvisation.

But the durable nonces alone would have been insufficient without administrative access. On March 27, Drift’s five-member Security Council multisig (a multi-signature wallet requiring multiple approvals for critical actions) was altered to a 2-of-5 threshold with zero timelock. That meant only two council members needed to approve a transaction, and there was no mandatory waiting period between approval and execution.

The attacker obtained those two approvals through social engineering, gaining protocol-level administrative control. With admin access secured, the attacker could modify vault parameters, disable safety checks, and execute the pre-signed withdrawal transactions in a single, devastating burst. The combination of durable nonces for timing control and multisig compromise for administrative access created an attack surface that no single security audit would have caught.

Cybersecurity professional monitoring threat alerts on screen
The combination of durable nonce abuse and multisig social engineering exposed structural weaknesses in DeFi governance models – Photo by Dan Nelson on Unsplash
Key point: The attacker spent three weeks building durable nonce accounts and engineering a multisig threshold change to 2-of-5 with zero timelock, then executed the entire $285M drain in 12 minutes.

North Korea’s Shadow: The 18th DPRK Attack of 2026

Both TRM Labs and Elliptic identified North Korean hackers as the probable architects of the Drift hack. TRM Labs noted that the attackers displayed “staggering” confidence, with transaction sizes and laundering speed that exceeded “the speed and aggressiveness of even the Bybit laundering of 2025.” The stolen funds were rapidly swapped into USDC through Solana-based DEX aggregators immediately after the drain.

The funds then moved cross-chain via bridges to the Ethereum network, where they were converted into ETH. Elliptic confirmed that on-chain behavioral patterns and laundering methodologies matched previous DPRK operations. Based on this analysis, the firm classified the incident as the 18th DPRK-attributed attack of 2026.

Why this matters: state-sponsored crypto theft has evolved from opportunistic raids into a systematic revenue model. According to Elliptic, DPRK-attributed total theft in 2026 alone has surpassed $300 million, with cumulative historical theft exceeding $6.5 billion. The three-week preparation period that began with a 10 ETH withdrawal from Tornado Cash on March 11 demonstrates the level of operational planning these groups now bring to DeFi exploits.

The DPRK connection also raises uncomfortable questions for the broader crypto ecosystem. Traditional financial sanctions have limited effectiveness when stolen funds can be swapped, bridged, and laundered across multiple blockchains within hours. The speed at which the Drift funds moved from Solana to Ethereum underscores the challenge regulators face in tracing and freezing illicit crypto flows.

TVL Collapse and Market Fallout

The market impact of the Drift hack was immediate and severe. TVL plummeted from $550 million to $230 million, while the DRIFT token crashed more than 40%, hitting an all-time low of $0.03343. Drift Protocol suspended all deposits and withdrawals, issuing a statement that it was “coordinating with multiple security firms, bridges, and exchanges to contain the incident.”

The damage extended well beyond Drift itself. Twenty projects were reportedly affected by cascading consequences of the exploit, as interconnected DeFi protocols on Solana experienced liquidity disruptions and user withdrawals driven by fear contagion. A single DEX exploit had metastasized into a broader confidence crisis across the Solana DeFi ecosystem.

For Solana, which had been gaining momentum as a high-throughput alternative to Ethereum for DeFi applications, the timing was particularly painful. The Drift exploit risked undermining the narrative of Solana as a mature, institutional-grade blockchain platform, serving as a stark reminder that speed and throughput mean little if the protocols built on top lack robust security architecture.

3D cube representing blockchain network architecture
Drift’s TVL collapse from $550M to $230M sent shockwaves across the Solana DeFi ecosystem – Photo by Shubham Dhage on Unsplash

The Airdrop Debate: Can the Bitfinex Model Work?

In the aftermath, Solana co-founder Anatoly Yakovenko proposed a recovery strategy modeled on Bitfinex’s response to its 2016 hack. The idea was to distribute IOU tokens to affected users, representing claims against future protocol revenue that would eventually make victims whole. Bitfinex had successfully used this approach to recover from its own breach, repaying all token holders over time.

The crypto community was skeptical. Bitfinex occupied a dominant market position at the time of its hack, with substantial recurring fee revenue that made repayment credible.

Drift, by contrast, operates in the fiercely competitive decentralized exchange market, and its liquidity had just been cut in half. Without a clear repayment path backed by sustainable revenue, the IOU model appeared more aspirational than practical.

The controversy deepened when on-chain analytics platform Onchain Lens reported that a wallet linked to the Drift team deposited 56.25 million DRIFT tokens, valued at approximately $2.44 million, into exchanges Bybit and Gate shortly after the hack. In the middle of a liquidity crisis, the movement of team-associated tokens to exchanges raised immediate questions about whether insiders were selling into the panic.

Whether the token transfers had an innocent explanation or not, the optics were devastating. Trust, once broken in DeFi, is extraordinarily difficult to rebuild. Users who had just watched their deposits evaporate were in no mood to extend the benefit of the doubt to team wallets moving tokens to centralized exchanges.

Related Posts
16 Digital Commodities, 90 ETFs: SEC Rewrites Crypto Rules

Structural Lessons for DeFi Security

The most critical failure exposed by the Drift hack was the vulnerability of multisig governance to social engineering. A five-member Security Council where only two approvals were needed, combined with zero timelock between approval and execution, created a security model that could be defeated by compromising just two individuals. No code audit in the world can protect against a governance structure that allows administrative takeover with minimal human compromise.

Oracle manipulation and fake collateral attacks are recurring patterns in DeFi exploits, and the Drift incident added a new chapter to an already lengthy playbook. The lesson is that individual smart-contract audits, while necessary, are insufficient against multi-vector attacks that combine social engineering, oracle manipulation, and blockchain feature abuse. Multisig threshold configuration, timelock enforcement, new collateral asset registration procedures, and oracle feed validation all need structural-level improvements.

The broader numbers paint a sobering picture. In the first nine months of 2025, total cryptocurrency hack losses reached $3.4 billion, with the Bybit compromise alone accounting for $1.5 billion. The Drift exploit continues a clear trend of escalating attack scale, suggesting that DeFi protocols must evolve their defenses beyond code security to encompass governance design and human-factor security.

The Drift hack ultimately delivered a message that the DeFi industry cannot afford to ignore: protocol security is only as strong as its weakest governance link. Whether Drift’s multisig threshold gets restructured and the DRIFT token finds a path to recovery will serve as the key indicators of how this story concludes. For every DeFi protocol relying on multisig governance, the question is no longer if these attacks will happen, but whether defenses are built to withstand them when they do.

Related Posts
Treasury’s First Stablecoin Regulation Reshapes $250B Market

References

Stay Ahead of the Curve

Get the latest insights on AI, tech, and markets — delivered in both Korean and English.

Explore More Posts

Disclaimer: This article is for informational purposes only and is not investment advice. It does not recommend buying or selling any specific security or digital asset. All investment decisions and their outcomes are the sole responsibility of the reader.