Major Exploit Hits Solana's Drift Protocol: $285 Million Lost

In a startling event, Solana-based Drift Protocol has experienced the largest exploit of 2026, resulting in the theft of nearly $300 million. This incident has raised significant alarm over the increasing risks posed by human-targeted attacks in the cryptocurrency landscape.

Key Takeaways

Drift Protocol suffered a significant exploit, losing approximately $285 million in assets.
The incident involved unauthorized access through durable nonces and social engineering methods.
It marked the largest cryptocurrency hack of 2026 and raised alarms over human-targeted vulnerabilities.
Both the Solana Foundation and security experts stressed the importance of improving operational security within the crypto space.

DeFi, crypto, Monero, Solana

Overview of the Exploit on Drift Protocol

On April Fool’s Day, Wednesday, Drift Protocol, a decentralized exchange (DEX) operating on the Solana blockchain, suffered a serious exploit that drained hundreds of millions from its vaults. Unusual on-chain activities were spotted, prompting Drift’s official channels to confirm the attack and swiftly halt deposits and withdrawals.

Drift Protocol confirms the attack. Source: X

Reportedly, the attack unfolded in under 20 minutes, resulting in a theft of approximately $285 million across various assets, including USDC, JPL, USDT, JUP, USDS, WBTC, and WETH, from nearly 20 vaults. This theft marks the most significant crypto exploit of the year so far and ranks among the largest hacks in the industry, surpassing WazirX’s $235 million hack.

The exploit led to a drastic decline in the total value locked (TVL) in the Drift Protocol, falling from around $550 million to $252 million, based on data from DeFiLlama. Additionally, the protocol’s token, DRIFT, suffered a near 40% drop in value within 24 hours following the incident.

Within hours post-exploit, the attacker managed to swap $270.9 million into USDC, bridged the funds from Solana to Ethereum using the CCTP TokenMessengerMinterV2, and acquired 129,000 ETH, distributing them across multiple wallets.

In a detailed Thursday announcement, Drift outlined how “a malicious actor gained unauthorized access to Drift Protocol through a novel attack involving durable nonces, resulting in a rapid takeover of Drift’s Security Council administrative powers.”

Durable nonces are an advanced feature on Solana that allows transactions to circumvent the usual short expiration limits of standard transactions. This functionality enables users to pre-sign transactions for later execution or complex workflows, thus complicating security measures.

“This operation was highly sophisticated and appears to have required weeks of preparation and staged execution, leveraging durable nonce accounts to pre-sign transactions for delayed execution,” the announcement continued.

Targeting Humans, Not Just Smart Contracts

Drift Protocol reassured its users that the exploit was not due to any bugs within its smart contracts, highlighting that there was no evidence of compromised seed phrases.

The attack involved unauthorized or misrepresented transaction approvals obtained before execution, likely facilitated through durable nonce mechanisms combined with advanced social engineering techniques.

Lily Liu, the President of the Solana Foundation, spoke about the implications of this incident, stating it represents a significant blow to the overall Solana ecosystem. Liu emphasized, “Smart contracts held up. The real targets now are humans: social engineering and operational security weaknesses, rather than code exploits.”

Charles Guillemet, CTO of Ledger, drew parallels between the method used in Drift’s exploit and the $1.4 billion hack of Bybit, believed to be linked to North Korean hacking units. He described that the attackers likely infiltrated machines belonging to multisig signers over an extended period, misleading operators into approving malicious transactions.

This pattern aligns closely with the Bybit hack last year, commonly associated with actors linked to North Korea. The trend is becoming evident: a methodical and sophisticated approach aimed at compromising the human and operational aspects, rather than the smart contracts themselves.

Guillemet underscored that this incident serves as “yet another wake-up call for the industry,” emphasizing the need to elevate security standards. He concluded, “True security is not solely reliant on code audits; it involves providing operators and users with the right information at the appropriate time, enabling them to make informed decisions regarding the transactions they authorize.”

Solana trades at $76 in the one-week chart. Source: SOLUSDT on TradingView