Solana-based DeFi platform Drift warns users about an “active attack” on its protocol; Arkham data: $250M+ moved from Drift to a wallet, which now holds <$600K
The platform halted deposits while it investigates suspicious activity and urges users to proceed with caution.
CoinDeskHelene Braun
Context & Ripple Effects
The related coverage shows the incident moving quickly from an initial protocol warning to on-chain evidence of a large transfer: Drift had already told users to use caution, and Arkham’s tracking made the scale of the exposure visible. Subsequent reporting says the episode was eventually described as a long-running social-engineering operation targeting Drift, rather than a routine wallet-security event.
The story matters beyond a single paused feature because it places a SolanaDeFi venue’s operating controls under stress while funds are moving. Later coverage connected the Drift episode with broader DeFi withdrawals after major exploits, including nearly $14B in reported investor outflows from DeFi.
First-order effects
Drift’s deposit halt immediately prevents users from adding funds while the protocol investigates, disrupting trading and capital deployment on the venue.
The reported movement of more than $250M to an interim wallet puts users and counterparties on notice that balances and protocol operations may be exposed; the wallet’s subsequently low balance makes tracing and recovery more urgent.
Second-order effects
Traders and liquidity providers can shift activity away from Drift until its controls and the status of affected funds are clearer, reducing available liquidity and fee-generating activity for the protocol.
The episode raises the value of real-time on-chain monitoring by firms such as Arkham, while other DeFi protocols face pressure to review operational-access and counterparty-vetting procedures in light of the later-reported fake quant-firm infiltration.
Third-order effects
If repeated large exploits prompt sustained withdrawals, DeFi platforms may compete increasingly on operational security, incident response, and transparency—not only yields and trading features.
The pattern points to a structural tension in DeFi: open, composable financial systems can make activity observable, but do not by themselves prevent compromise of the people and processes controlling protocol operations.
The trend: This is one data point in DeFi’s shift from growth-led competition toward security and operational trust as core determinants of where capital stays.
We are observing unusual activity on the protocol. We are currently investigating. Please do not deposit funds into the protocol while we investigate. This is not an April Fools joke. Proceed with caution until further notice. We'll provide additional updates from this account.
Drift Protocol is experiencing an active attack. Deposits and withdrawals have been suspended. We are coordinating with multiple security firms, bridges, and exchanges to contain the incident. This is not an April Fools joke. We'll provide additional updates from this account as
Drift Protocol appears to have been exploited, with over $270M in assets suspiciously transferred to wallet HkGz4K. 🚨 That's crazy! https://intel.arkm.com/... [image]
The Drift Protocol exploiter is swapping the $270M+ stolen assets into $USDC, then bridging to #Ethereum to buy $ETH. 🚨 So far, they have bought 19,913 $ETH ($42.6M). https://intel.arkm.com/... https://x.com/... [image]
Drift summary: - $200M stolen and no one noticed for an hour - Apparently a single compromised admin key (lol) - Hacker still came in for seconds 2 hours after the hack to drain a few extra millions - Hacker still bridging out $USDC 3 hours after the hack wp everyone
The Drift Protocol exploiter also deposited $SOL into #HyperLiquid and sold it to buy $ETH. The Drift Protocol exploiter even deposited $SOL into #Binance. https://intel.arkm.com/... https://x.com/... [image]
We're aware of reports regarding Drift Protocol, and our security team is investigating. Users trying to access Drift through Phantom will see a required warning that there may be unique risks in accessing Drift right now. Those who still want to access their funds will have the
Jupiter is not affected by the Drift situation. Jupiter Lend has no exposure to Drift's markets and JLP is fully backed by the underlying assets. That said, this a difficult day for Solana DeFi and our heart goes out to the Drift team and everyone affected.
Almost wanted to say something about code safety, but hearing it's not even that. Sounds like a usual risk management failure in a lending protocol + drain via a “weak collateral”. Anyhow, DeFi on Ethereum went over these lessons already. Solana ecosystem is still learning
Drift hack + Backpack TGE issues show why Solana DEX volume is struggling. Public order books = easy front-running. Hyperliquid is winning. @GoDark fixes it: decentralized dark pool on Solana. Hidden orders. No MEV. Full self-custody. Fast and private execution.
Watch who starts bashing in times like these when people are down, get receipts because those people you should unfollow/block. This is a terrible look on our entire industry. This is a very shit situation, we don't know how the exploit/hack happened, what the vector was,
A quick note on the recent developments around Drift. USD* is not affected. USD* has no counterparty exposure to Drift, and USD*'s yield strategies do not depend on Drift. However redemptions are temporarily paused as a precaution to ensure user safety.