Drift Protocol Multisig Compromise Removed Withdrawal Caps and Enabled Asset Theft

Drift Protocol was compromised after an attacker gained control of a newly created 2-of-5 Squads v4 admin multisig during a migration from an older 3-of-5 setup. Investigation notes say the migration replaced four of five original members, lowered the approval threshold, and left no timelock, allowing the attacker—who controlled two signer accounts—to use a dual durable nonce pre-signing technique to transfer protocol admin rights to a wallet under their control in less than two seconds. Shortly before the admin takeover, the attacker also withdrew $10,000 USDC from the insurance fund.

With unilateral admin access, the attacker used the UpdateWithdrawGuardThreshold capability to remove withdrawal caps across 16 spot markets, then created fake collateral markets backed by an attacker-controlled token and oracle to extract real assets from the protocol. Public proof-of-concept material highlighted how the withdrawal guard change could eliminate all withdrawal limits, while on-chain analysis linked the attacker-controlled signers through durable nonce accounts funded by the same wallet, identifying shared nonce funding as a key early warning indicator. Drift later moved protocol upgrade authority to a recovery multisig that excluded the compromised members, but reporting indicated Drift Vaults upgrade authority still remained on a multisig where the attacker retained a seat.