Drift

DeFi

ZachXBT

April

Security

On April 1, 2026, Solana-based Drift Protocol was exploited for approximately $285 million, making it the largest DeFi hack of the year, to date. The attacker used a multi-week setup involving a fake token, manipulated price feeds, and pre-signed transactions to seize admin control of the protocol, then drained real user funds in under 12 minutes.
<div>
 <blockquote class="twitter-tweet">
 <a href="https://twitter.com/hashtag/PeckShieldAlert?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#PeckShieldAlert</a> Drift Protocol <a href="https://twitter.com/DriftProtocol?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@DriftProtocol</a> has been exploited, resulting in a loss of over $285M - more than 50% of its TVL. <a href="https://twitter.com/search?q=%24DRIFT&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$DRIFT</a> has plummeted by -37%. The exploiter has already bridged the stolen assets from <a href="https://twitter.com/hashtag/Solana?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#Solana</a> to <a href="https://twitter.com/hashtag/Ethereum?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#Ethereum</a> via the CCTP TokenMessengerMinterV2,… <a href="https://t.co/EZE4tP0f6c" rel="noopener noreferrer nofollow">pic.twitter.com/EZE4tP0f6c</a>— PeckShield <a href="https://twitter.com/PeckShieldAlert/status/2039546185120387169?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">April 2, 2026</a>
 </blockquote>
</div>
<h2 id="span-span-strong-what-happened-to-drift-protocol-on-april-1-strong-span-span">What Happened to Drift Protocol on April 1?</h2>
The attack did not come out of nowhere. According to the Drift Protocol team, it was the result of days of preparation that only became visible when the damage was already done.
Drift's total value locked (TVL) dropped from roughly $550 million to under&nbsp;<a href="https://defillama.com/protocol/drift" rel="noopener noreferrer nofollow">$300 million</a> in less than an hour. The DRIFT token fell more than 40% during the incident. Security firm PeckShield&nbsp;<a href="https://x.com/PeckShieldAlert/status/2039546185120387169" rel="noopener noreferrer nofollow">confirmed</a> the loss exceeded $285 million, representing more than 50% of the protocol's TVL at the time.
The timing caused immediate confusion. Drift's team posted on X to clarify the situation was real, writing: "This is not an April Fools joke. Proceed with caution until further notice."
The protocol suspended all deposits and withdrawals as the investigation began.
<h2 id="span-span-strong-how-did-the-attacker-set-up-the-exploit-days-in-advance-strong-span-span">How Did the Attacker Set Up the Exploit Days in Advance?</h2>
Per reports the attacker spent at least 9 days building the conditions for the theft before executing it.
<h3 id="span-span-strong-the-fake-token-and-the-oracle-trap-strong-span-span">The Fake Token and the Oracle Trap</h3>
The attacker created a token called&nbsp;<a href="https://x.com/DriftProtocol/status/2039564439737766223?s=20" rel="noopener noreferrer nofollow">CarbonVote Token (CVT)</a>, minting approximately 750 million units. They seeded a liquidity pool on Raydium with just $500 and used wash trading, buying and selling the token between their own wallets, to build a fake price history near $1. Over time, on-chain price oracles picked up this artificial price and treated CVT as a legitimate asset worth roughly $1 per token.
An oracle is a service that feeds external price data into a smart contract. When an oracle is fed manipulated data, the smart contract has no way to know the price is fake.
<h3 id="span-span-strong-the-durable-nonce-attack-strong-span-span">The Durable Nonce Attack</h3>
Separately, the attacker used a Solana feature called durable nonces to pre-sign transactions and delay their execution. A durable nonce replaces the normal transaction expiry mechanism, allowing a signed transaction to be held and submitted at any point in the future.
The timeline:
<ul>
 <li>March 23: Four durable nonce accounts were created. Two were linked to real Drift Security Council multisig members. Two were controlled by the attacker.</li>
 <li>March 27: Drift migrated its Security Council due to a planned member change. The attacker obtained access to two signers in the updated multisig as well.</li>
 <li>March 30: A new durable nonce account was created for a member of the updated multisig.</li>
 <li>April 1: The attacker executed two pre-signed durable nonce transactions, four slots apart, completing an admin transfer that handed them control of protocol-level permissions.</li>
</ul>
With admin access secured, the attacker listed CVT as a valid market on Drift, removed all withdrawal limits, deposited hundreds of millions of CVT tokens as collateral, and then executed 31 rapid withdrawals draining real assets, including USDC, JLP, SOL, wrapped BTC, Jito (JTO), and the Fartcoin (FRT) memecoin, in approximately 12 minutes.
Drift confirmed the attack did not result from a bug in its smart contracts or any compromised seed phrases. Instead, it involved "unauthorized or misrepresented transaction approvals obtained prior to execution."
Security audits by Trail of Bits in 2022 and ClawSecure in February 2026 had cleared Drift, but neither review caught the CVT market introduction or the governance changes that made the attack possible.
<h2 id="span-span-strong-where-did-the-stolen-funds-go-strong-span-span">Where Did the Stolen Funds Go?</h2>
After the exploit, the attacker moved quickly to obscure the trail.
Stolen assets were converted to USDC and SOL, then bridged from Solana to Ethereum using Circle's Cross-Chain Transfer Protocol (CCTP). On Ethereum, the attacker converted the funds into ETH. According to on-chain tracking, the attacker ultimately accumulated 129,066 ETH, worth approximately&nbsp;<a href="https://x.com/lookonchain/status/2039518230222655742" rel="noopener noreferrer nofollow">$273 million</a> at the time.
The attacker also deposited SOL into both HyperLiquid and Binance, complicating tracing efforts across multiple platforms and wallets.
<h2 id="span-span-strong-did-circle-do-enough-to-stop-the-theft-strong-span-span">Did Circle Do Enough to Stop the Theft?</h2>
On-chain investigator ZachXBT&nbsp;<a href="https://x.com/zachxbt/status/2039496650906034602" rel="noopener noreferrer nofollow">publicly criticized</a> Circle after the exploit, pointing out that large amounts of stolen USDC were bridged from Solana to Ethereum during U.S. business hours without being frozen.
<div>
 <blockquote class="twitter-tweet">
 Circle was asleep while many millions of USDC was swapped via CCTP from Solana to Ethereum for hours from the 9 figure Drift hack during US hours. Value was moved and nothing was done yet again. Comes days after you froze 16+ business hot wallets incompetently which is still… <a href="https://t.co/T0Xwg1HIfO" rel="noopener noreferrer nofollow">pic.twitter.com/T0Xwg1HIfO</a>— ZachXBT (@zachxbt) <a href="https://twitter.com/zachxbt/status/2039496650906034602?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">April 2, 2026</a>
 </blockquote>
</div>
ZachXBT contrasted this response with Circle's recent decision to freeze 16 unrelated corporate hot wallets in a sealed U.S. civil case, arguing that Circle had both the ability and the precedent to intervene but failed to act quickly enough to limit the damage.
<h2 id="span-span-strong-which-protocols-were-affected-beyond-drift-strong-span-span">Which Protocols Were Affected Beyond Drift?</h2>
The fallout extended across Solana's DeFi ecosystem. Several platforms connected to Drift liquidity paused operations or reported losses:
<ul>
 <li>PiggyBank_fi reported roughly $106,000 in exposure through delta-neutral strategies and covered users directly using team funds.</li>
 <li>Reflect Money paused minting and redemptions for USDC+ and USDT+.</li>
 <li>Ranger Finance halted RGUSD deposits and withdrawals, with estimated exposure above $900,000.</li>
 <li>Project0 stopped borrowing against Drift positions as a precaution.</li>
 <li>TradeNeutral, GetPyra, xPlace, Uselulo, and Elemental DeFi all paused key features or reported limited exposure.</li>
 <li>Jupiter Exchange confirmed its JLP pool remains fully backed.</li>
</ul>
<h2 id="span-span-strong-what-happens-next-for-drift-strong-span-span">What Happens Next for Drift?</h2>
Drift is coordinating with multiple security firms, exchanges, bridges, and law enforcement to trace and recover stolen assets. The multisig has been updated to remove the compromised wallet. All remaining protocol functions remain frozen.
According to Immunefi&nbsp;<a href="https://x.com/MitchellAmador/status/2036532448461279269" rel="noopener noreferrer nofollow">CEO Mitchell Amador</a>, the token price impact often outlasts the exploit itself. Immunefi data shows 83% of native tokens from hacked protocols never recover to pre-hack prices.
A detailed postmortem from Drift is expected in the coming days.
<h2 id="span-span-resources-span-span">Resources</h2>
<ol>
 <li><a href="https://x.com/PeckShieldAlert" rel="noopener noreferrer nofollow">PeckShield on X</a>: Posts (April 1-2)</li>
 <li><a href="https://x.com/lookonchain" rel="noopener noreferrer nofollow">Lookonchain on X</a>: Posts (April 1-2)</li>
 <li><a href="https://x.com/DriftProtocol" rel="noopener noreferrer nofollow">Drift Protocol on X</a>: Posts (April 1-2)</li>
 <li><a href="https://x.com/MitchellAmador/status/2036532448461279269" rel="noopener noreferrer nofollow">Mitchell Amador on X</a>: Post on March 25</li>
</ol>

Drift Protocol Hacked for $285M: What Went Wrong and What Happens Next

Table of Contents

BSCN

Other articles published on Apr 7, 2026

Join our free newsletter for daily crypto updates!