Drift exploit drains $285M+, freezing Pyra user funds
Security & Exploits ·
A hack on the Drift protocol has locked up all Pyra user deposits held there for yield and credit, with losses now estimated above $285 million.
The exploit hit Drift at 16:05 UTC on April 1st, 2026, according to a statement from Pyra, which said the loss totaled $285M+ of Drift's user funds. Because Pyra routes user deposits into Drift for yield and credit, the statement said all Pyra user funds are affected by the incident. Early on-chain analysis in the cluster had put the figure at $200M+ before the estimate rose to $285M, and separate reporting described the exploit as pulling 8.8% of Solana's chain TVL out within 24 hours, adding to broader skepticism about the ecosystem.
Drift has suspended deposits and withdrawals while coordinating with security firms, bridges, and exchanges, per Pyra's statement. Pyra said it has likewise suspended card spend and new sign-ups for the duration of the incident. Any new deposits to Pyra addresses will no longer be routed into Drift and will instead sit in the user's self-custody keypair, which the statement said can be exported at any time through the Pyra app. Pyra also said it has begun switching credit providers to move away from Drift so it can resume operations.
Existing balances remain locked for now. Pyra's statement clarified that the balance shown in its app reflects a user's position in Drift's ledger rather than tokens actually sitting in the pool, since those funds were lost in the exploit and are not currently available to withdraw.
Separately in the cluster, ZachXBT criticized Circle for inaction during the exploit, alleging that millions in USDC stolen in the hack were bridged from Solana to Ethereum via CCTP despite Circle having demonstrated wallet-freezing capability and, in a related allegation, that Circle failed to monitor or halt those CCTP transfers altogether.
Pyra's statement pointed to possible avenues for tracing the attacker, noting the use of bridges and exchanges while funding and withdrawing, plus use of Phantom, which the statement said tracks IP and other user information. It also cited the ByBit and Loopscale hacks in 2025 as cases where stolen funds were eventually returned. Whether Drift recovers any of the $285M+, when withdrawals might reopen, and whether Circle acts on the CCTP transfers remain unresolved.