Solana DeFi Hit by Major Drift Protocol Exploit; $285M Stolen and DRIFT Drops 42%
Drift Protocol, a widely used DeFi platform on Solana, has been hit by an exploit that drained more than $285 million after an attacker obtained control of critical administrative permissions.
Blockchain security firm Slowmist said the attack began around 4 PM UTC, with an initial transfer of about $155 million in JLP tokens pulled from a Drift vault. Losses later climbed above $285 million, erasing more than half of the protocol's total value locked.
On-chain activity indicates the attacker moved the proceeds cross-chain. Roughly 129,000 ETH, valued at about $270.9 million, was bridged from Solana to Ethereum using CCTP TokenMessengerMinterV2. The funds were split across multiple wallets, including transfers of 55.4K ETH, 25.7K ETH, 24.9K ETH, and 23.1K ETH, a pattern consistent with efforts to reduce tracing risk. Prior to bridging, the exploiter swapped assets into USDC via Jupiter, then converted the USDC into ETH.
The operation appeared to involve significant preparation. Three weeks before the exploit, the attacker created a token on Solana called CarbonVote Token and seeded it with $500 of liquidity. By repeatedly wash trading, the actor established an artificial but stable price history intended to mislead oracle systems.
Drift said the attacker used a technique involving durable nonces and presigned transactions, which can be executed at a later time, enabling unauthorized control to be established without immediate detection. Multiple multisig signers were also reportedly compromised, with indications pointing to targeted social engineering.
Following the incident, DRIFT slid sharply, falling as much as 42% over the day to around $0.041. Earlier pricing in the move showed the token down 37% to $0.048. Drift has suspended deposits and withdrawals and warned users not to interact with the platform while the team works with security firms, bridges, exchanges, and law enforcement to trace and freeze the stolen assets. A detailed postmortem is expected in the coming days.
