Drift Protocol, a Solana-based perpetuals DEX, exploited for approximately $285 million.
Security & Exploits ·
Drift Protocol, a Solana-based perpetuals exchange, suffered an exploit on Wednesday that resulted in the theft of more than $200 million in funds, with some estimates placing losses at $285 million. The protocol suspended deposits and withdrawals after suspicious transfers began appearing around 11:06 a.m., when approximately 41 million JLP tokens valued at $155 million moved from the Drift vault to a Solana address. Additional transfers followed, with blockchain analytics tracking total outflows exceeding $250 million to the attacker's address.
The attack is suspected to stem from a leaked or compromised private key that granted the attacker privileged access to Drift's admin functionality and vaults, according to security researchers including those at blockchain security firm PeckShield. The malicious address was first funded a week prior and may have maintained access to the exploit mechanism since that time. Drift had $550 million in total value locked before the incident and coordinates with multiple security firms, bridges, and exchanges to contain the breach.
The exact vector and full scope of the compromise remain under investigation. Whether the leaked credentials belonged to a single admin key or multiple parties, and what recovery mechanisms may be available to affected users, have not yet been clarified by the protocol or authorities.