Drift Protocol loses $280M after social-engineered multisig takeover

Drift Protocol, a Solana-based decentralized exchange, lost roughly $270 million to $286 million after attackers seized its Security Council administrative powers and drained core vaults, prompting the platform to suspend deposits and withdrawals and warn users not to add funds. Drift later said the theft was not caused by a smart contract bug or leaked seed phrases, but by a sophisticated operation that abused Solana durable nonce transactions and pre-signed multisig approvals to execute malicious governance changes later. Investigators and Drift said the attackers removed withdrawal limits, introduced a fake collateral asset called CVT or CarbonVote Token, manipulated controls, and rapidly moved assets out of borrow/lend products, vault deposits, and trading funds, cutting the protocol’s total value locked from about $550 million to below $250 million and sending the DRIFT token sharply lower.

Subsequent post-mortems described the breach as the culmination of a months-long social-engineering campaign in which the threat actors posed as a legitimate quantitative trading firm, built trust through conferences, Telegram chats, integrations, and deposits, and likely compromised contributors through a malicious code repository and a trojanized TestFlight wallet app. Blockchain intelligence firms including Elliptic and TRM Labs said the laundering patterns, cross-chain bridging from Solana to Ethereum, use of Tornado Cash, and other indicators were consistent with North Korean tradecraft, while Drift linked the operation with medium confidence to UNC4736 / AppleJeus / Citrine Sleet. The fallout widened beyond Drift as critics questioned why more than $230 million in USDC moved through Circle’s CCTP bridge without being frozen, Solana launched new security initiatives, and Drift later secured recovery backing including up to $127.5 million from Tether as it worked with security firms, exchanges, bridges, and law enforcement to trace and recover funds.