Drift

Solana

ZachXBT

USDC

Balancer

Drift Protocol, a Solana-based decentralized exchange (DEX), confirmed Thursday it was targeted in a roughly $280 million exploit, describing it as a “highly sophisticated operation.”
The platform took to X on to share its findings from a preliminary investigation, saying that the attackers exploited Solana’s durable nonces, a mechanism enabling pre-signed transactions, to seize control and drain funds. The protocol had earlier said it was experiencing an active attack and suspended deposits and withdrawals while coordinating with security firms, bridges and exchanges.
The attack began on Wednesday, with the <a href="https://cointelegraph.com/news/drift-protocol-pause-deposit-unusual-activity" rel="noopener noreferrer nofollow">theft involving multiple assets</a>, including Circle’s USDC (<a href="https://cointelegraph.com/usdc-price-index" rel="noopener noreferrer nofollow">USDC</a>) and various altcoins. Onchain data later <a href="https://x.com/lookonchain/status/2039399827809996904?s=20" rel="noopener noreferrer nofollow">showed</a> that the exploiter swapped the majority of assets into USDC, with the funds later bridged to Ethereum.
The incident has attracted scrutiny not only because it appears to involve abuse of a legitimate Solana transaction feature rather than a plain smart contract failure, but also for how funds moved across chains for hours without being frozen, raising questions about intervention by centralized stablecoin issuers.
<figure><img src="https://s3.cointelegraph.com/uploads/2026-04/019d4d6f-b632-76a3-95da-f5795e6f0e9e.png" alt="Drift explains $280M exploit as critics question Circle over USDC freeze">
 <figcaption>Source: <a href="https://x.com/DriftProtocol/status/2039564439737766223?s=20" rel="noopener noreferrer nofollow">Drift</a>
 </figcaption>
</figure>
<h2 id="what-is-solana-s-durable-nonce-feature">What is Solana’s durable nonce feature?</h2>
Solana’s durable nonces are a unique feature <a href="https://solana.com/developers/guides/advanced/introduction-to-durable-nonces#durable-nonce-applications" rel="noopener noreferrer nofollow">allowing</a> transactions to bypass certain expiration windows and enabling users to pre-sign transactions for future execution, offline signing, or complex multisig workflows.
Drift said the attacker used durable nonce-based, pre-signed transactions to gain unauthorized administrative access and execute malicious actions quickly after submission.
<figure><img src="https://s3.cointelegraph.com/uploads/2026-04/019d4d6f-b87c-7290-9465-f1211235e95b.png" alt="Drift explains $280M exploit as critics question Circle over USDC freeze">
 <figcaption>Source: <a href="https://x.com/DriftProtocol/status/2039564441256083878?s=20" rel="noopener noreferrer nofollow">Drift</a>
 </figcaption>
</figure>
Durable nonces have not been widely associated with major exploits on their own, but developers have <a href="https://dev.to/ohmygod/anatomy-of-a-solana-wallet-drainer-owner-reassignment-durable-nonces-and-blinks-phishing-50a8" rel="noopener noreferrer nofollow">noted</a> that features enabling delayed execution can introduce complexity and potential risks if misused or combined with other vulnerabilities.
<h2 id="questions-over-circle-s-response">Questions over Circle’s response</h2>
The incident has sparked criticism of the USDC issuer Circle, as the attacker took hours to swap $270 million to the stablecoin before bridging to Ethereum.
Onchain sleuth ZachXBT and others said the company had at least six hours to freeze funds but did not act, contrasting the response with previous cases where wallets were <a href="https://x.com/peckshield/status/1677368853725077521" rel="noopener noreferrer nofollow">blacklisted</a>.
<figure><img src="https://s3.cointelegraph.com/uploads/2026-04/019d4d6f-bc61-7fa5-8652-beff7c16665e.png" alt="Drift explains $280M exploit as critics question Circle over USDC freeze">
 <figcaption>The Drift exploiter had bought 130,262 ($267 million) Ether in total by publishing time. Source: <a href="https://x.com/lookonchain/status/2039614071704797489?s=20" rel="noopener noreferrer nofollow">Lookonchain</a>
 </figcaption>
</figure>
Some industry figures pointed to the gap between Circle’s ability to freeze funds and any obligation to do so.
“Circle could freeze it. But they’re not required to,” pseudonymous user Molu <a href="https://x.com/molusol/status/2039454934823800839" rel="noopener noreferrer nofollow">wrote</a> on X, adding that proposed regulatory frameworks such as the <a href="https://cointelegraph.com/news/genius-act-heads-donald-trump-signing-what-will-change" rel="noopener noreferrer nofollow">GENIUS Act</a> could change that dynamic by requiring intervention under finalized rules.
Related: <a href="https://cointelegraph.com/news/balancer-labs-shuts-down-protocol-continues" rel="noopener noreferrer nofollow">Balancer Labs shuts down 4 months after $100M+ exploit, protocol to continue</a>
The incident marks yet another case in the ongoing debate over intervention by centralized platforms during attacks, with ZachXBT repeatedly criticizing Circle over the issue.
The investigator previously <a href="https://x.com/zachxbt/status/1895515696496365574" rel="noopener noreferrer nofollow">questioned</a> Circle’s response to USDC tied to a Bybit-related hack in late February, prompting a response from Circle CEO Jeremy Allaire, who <a href="https://x.com/jerallaire/status/1895870120146428047" rel="noopener noreferrer nofollow">said</a> the company acts on law enforcement requests before freezing funds.
Magazine: <a href="https://cointelegraph-magazine.com/dirty-secret-quantum-signatures-no-one-knows/" rel="noopener noreferrer nofollow">Nobody knows if quantum secure cryptography will even work</a>

Drift explains $280M exploit as critics question Circle over USDC freeze

Table of Contents

Cointelegraph

Other articles published on Apr 2, 2026

Join our free newsletter for daily crypto updates!