Drift Protocol suffered significant financial losses, totaling at least $280 million, after a malicious actor gained unauthorized access to its Security Council’s administrative privileges through a carefully orchestrated and complex attack.

The attacker exploited persistent nonce accounts and pre-approved transactions, allowing them to postpone the attack and execute it precisely when desired, the platform detailed.

Drift emphasizes that the intrusion didn’t result from vulnerabilities in its code or smart contracts, and no user’s private keys were compromised.

Drift Protocol is a decentralized finance (DeFi) trading platform operating on the Solana blockchain, functioning as a non-custodial exchange where users maintain complete ownership of their assets while engaging in on-chain trading activities.

Near the end of 2024, the platform reported a user base of 200,000 traders, with total trading volumes exceeding $55 billion and a daily trading peak of $13 million.

According to Drift’s announcement, the attack was planned between March 23rd and 30th, with the attacker establishing durable nonce accounts and securing 2 out of 5 required approvals from Security Council members.

This allowed the attacker to pre-approve fraudulent transactions that weren’t immediately processed.

On April 1st, the attacker executed a legitimate transaction and then immediately initiated the pre-approved malicious transactions, swiftly transferring administrative control to their own account within minutes.

Once the attacker obtained administrative control, they introduced a harmful asset, removed withdrawal restrictions, and ultimately stole funds.

Drift Protocol estimates the damages to be approximately $280 million, while blockchain analysis firm PeckShieldAlert estimates the loss to be around $285 million.

Upon detecting unusual activity on the protocol, Drift issued a public alert to its users, stating that they had commenced an investigation and advising them against depositing any funds until further instructions were released.

The attack has impacted borrow/lend deposits, vault deposits, and trading funds, effectively halting all protocol operations. Drift stated the DSOL and insurance funds are safe.

The platform is now working with cybersecurity companies, cryptocurrency exchanges, and legal authorities to track and recover the stolen funds.

Drift has committed to publishing a comprehensive post-incident report in the coming days.