Solana-based DeFi platform Drift warns users about an “active attack” on its protocol; Arkham data: $250M+ moved from Drift to a wallet, which now holds <$600K
CoinDeskHelene Braun
Context & Ripple Effects
The incident followed two consecutive alerts in which on-chain tracking showed more than $250M moving from Drift-controlled addresses into an interim wallet. The wallet’s rapidly diminished balance made the immediate issue not just detecting a compromise, but tracing assets once they had moved onward.
Drift users and counterparties face an immediate security and liquidity-risk event while the protocol investigates the attack and tracks funds that have already left the visible interim wallet.
Arkham’s on-chain observations give investigators and users a public trail, but the low remaining wallet balance suggests the suspected attacker had already dispersed much of the moved value.
If repeated social-engineering-led breaches continue, DeFi risk assessment will shift further from smart-contract audits alone toward operational security, counterparty verification, and incident-response readiness.
Public blockchain data can improve post-incident tracing, but it does not prevent rapid asset dispersion; the durable competitive divide may be between protocols that can demonstrate both transparent monitoring and credible safeguards around human access points.
The trend: This is one data point in DeFi’s shift from code-only security assumptions toward broader operational-risk controls as protocols seek to retain user trust after large exploits.
We are observing unusual activity on the protocol. We are currently investigating. Please do not deposit funds into the protocol while we investigate. This is not an April Fools joke. Proceed with caution until further notice. We'll provide additional updates from this account.
Drift Protocol is experiencing an active attack. Deposits and withdrawals have been suspended. We are coordinating with multiple security firms, bridges, and exchanges to contain the incident. This is not an April Fools joke. We'll provide additional updates from this account as
The Drift Protocol exploiter is swapping the $270M+ stolen assets into $USDC, then bridging to #Ethereum to buy $ETH. 🚨 So far, they have bought 19,913 $ETH ($42.6M). https://intel.arkm.com/... https://x.com/... [image]
Drift Protocol appears to have been exploited, with over $270M in assets suspiciously transferred to wallet HkGz4K. 🚨 That's crazy! https://intel.arkm.com/... [image]
Almost wanted to say something about code safety, but hearing it's not even that. Sounds like a usual risk management failure in a lending protocol + drain via a “weak collateral”. Anyhow, DeFi on Ethereum went over these lessons already. Solana ecosystem is still learning
Drift hack + Backpack TGE issues show why Solana DEX volume is struggling. Public order books = easy front-running. Hyperliquid is winning. @GoDark fixes it: decentralized dark pool on Solana. Hidden orders. No MEV. Full self-custody. Fast and private execution.
Watch who starts bashing in times like these when people are down, get receipts because those people you should unfollow/block. This is a terrible look on our entire industry. This is a very shit situation, we don't know how the exploit/hack happened, what the vector was,
A quick note on the recent developments around Drift. USD* is not affected. USD* has no counterparty exposure to Drift, and USD*'s yield strategies do not depend on Drift. However redemptions are temporarily paused as a precaution to ensure user safety.
We're aware of reports regarding Drift Protocol, and our security team is investigating. Users trying to access Drift through Phantom will see a required warning that there may be unique risks in accessing Drift right now. Those who still want to access their funds will have the
Jupiter is not affected by the Drift situation. Jupiter Lend has no exposure to Drift's markets and JLP is fully backed by the underlying assets. That said, this a difficult day for Solana DeFi and our heart goes out to the Drift team and everyone affected.
Drift summary: - $200M stolen and no one noticed for an hour - Apparently a single compromised admin key (lol) - Hacker still came in for seconds 2 hours after the hack to drain a few extra millions - Hacker still bridging out $USDC 3 hours after the hack wp everyone
The Drift Protocol exploiter also deposited $SOL into #HyperLiquid and sold it to buy $ETH. The Drift Protocol exploiter even deposited $SOL into #Binance. https://intel.arkm.com/... https://x.com/... [image]