Drift Protocol: $280M Exploit Tied to Suspected Social Engineering, Not Smart Contract Flaw

Drift Protocol issued an update on the $280 million exploit, saying the attack was planned over several weeks and leveraged durable nonce accounts. The incident required only 2 of 5 multisig approvals to transfer full admin control, and the team said it found no evidence of a smart contract bug or a seed phrase leak. The protocol believes social engineering may have been used to secure fraudulent multisig approvals. Drift said impacted funds include all deposits into borrow/lend, vault deposits, and funds deposited for trading. It added that DSOL not deposited in Drift"including assets staked to the Drift Validator"is unaffected. Insurance Fund assets will be withdrawn from the protocol for safeguarding. All protocol functions have been frozen, and the compromised wallet has been removed.