Stablecoin

Drift

Raydium

Read

Echoes

A sophisticated exploit targeting Drift Protocol appears to have drained an estimated $285 million after an attacker manipulated oracle pricing using a fabricated token, leveraged a compromised admin key and <a href="https://yellow.com/news/drift-protocol-exploit-solana" rel="noopener noreferrer nofollow">disabled core withdrawal safeguards</a>.
<h2 id="fake-collateral-built-weeks-in-advance">Fake Collateral Built Weeks In Advance</h2>
According to on-chain analysis shared by independent researcher Ares, the exploit began weeks before the actual drain. The attacker minted 750 million units of a fake asset called “CarbonVote Token” (CVT) and created a liquidity pool on Raydium (<a href="https://yellow.com/asset/ray" rel="noopener noreferrer nofollow">RAY</a>) with just $500 in liquidity, artificially setting its price near $1.
Over several weeks, the attacker reportedly wash traded the token to build a credible on-chain price history, allowing it to be picked up by oracle mechanisms as legitimate collateral value.
<h2 id="admin-key-compromise-and-safeguard-removal">Admin Key Compromise And Safeguard Removal</h2>
On April 1, the attacker used a compromised Drift admin key to list CVT as a spot market. In the same transaction, withdrawal guard thresholds across multiple markets were raised to extreme levels, effectively disabling limits designed to prevent large outflows.
Also Read: <a href="https://yellow.com/news/bitcoin-market-phase-2022-parallel" rel="noopener noreferrer nofollow">Bitcoin Redistribution Phase Echoes Q2 2022 Bear Market - Glassnode Report</a>
The attacker then deposited approximately 785 million CVT, valued at $785 million based on the manipulated oracle price, across multiple accounts.
<h2 id="vaults-drained-in-minutes">Vaults Drained In Minutes</h2>
Using the inflated collateral, the attacker executed 31 withdrawal transactions in roughly 12 minutes, draining assets across multiple vaults.
These included $66.4 million in <a href="https://yellow.com/asset/usdc" rel="noopener noreferrer nofollow">USDC</a>, $42.7 million in <a href="https://yellow.com/asset/jlp" rel="noopener noreferrer nofollow">JLP</a>, $23.3 million in MOODENG (<a href="https://yellow.com/asset/moodeng" rel="noopener noreferrer nofollow">MOODENG</a>) and smaller amounts of other tokens.
Funds were subsequently consolidated, partially burned through perpetual liquidity removal and converted into <a href="https://yellow.com/asset/sol" rel="noopener noreferrer nofollow">SOL</a> before being distributed across multiple wallets.
The use of multiple signing keys suggests either a broader compromise of operational infrastructure or access to privileged credentials, raising further concerns about internal security controls.
Read Next: <a href="https://yellow.com/news/clarity-act-stablecoin-agreement" rel="noopener noreferrer nofollow">CLARITY Act Stablecoin Deal Could Come Within 48 Hours, Coinbase CLO Predicts</a>

How Attackers Turned $500 Into $285M: The Drift Hack Breakdown

Table of Contents

Yellow News

Other articles published on Apr 1, 2026

Join our free newsletter for daily crypto updates!