# Drift Protocol Exploit — April 2026

## 1. What happened

On **April 1, 2026**, attackers drained Drift Protocol, a Solana-based perpetuals and lending platform, of approximately **$285.26 million** across 18 tokens in 128 seconds. The largest losses were ~$159M in JLP (Drift's liquidity provider token) and ~$71.4M in USDC. The vault balance collapsed from ~$309M to under $8M.

Source: https://rekt.news/drift-protocol-rekt/

Drift's own post-mortem and security-firm analyses (BlockSec, SlowMist, CertiK, Halborn, Verichains, QuillAudits) were not accessible at the time of writing: Medium returned 403, the Drift docs site (now redirecting to velocity.exchange) returned 500, and firm blog URLs returned 403/404. The rekt.news article cites Drift's public statements, ZachXBT's on-chain tracing, and comments from Hayden Adams and Taylor Monahan, and is the primary source for all facts below.

## 2. Root cause

This was **not a smart-contract bug**. The exploit was the final step of a six-month social-engineering operation attributed with medium-high confidence to **UNC4736** (AppleJeus/Citrine Sleet), a North Korean state-affiliated group. Operatives posed as a quantitative trading firm, met Drift contributors at conferences starting around October 2025, onboarded an Ecosystem Vault with over $1M, and eventually delivered malware through shared code repositories or a weaponized TestFlight application that exploited a vulnerability in VSCode/Cursor to gain access to contributor machines. Once inside, they obtained pre-signed transactions from multisig signers using Solana's durable nonce feature. Critically, Drift's governance used a **2-of-5 multisig with no timelock** — any two signers could authorize instant, irreversible admin-level changes. Attackers used the pre-signed nonces to transfer ownership of Drift's State account, created a collateral market for a wash-traded fake token (CarbonVote Token, CVT) with maximal borrowing parameters, deposited 500M CVT at negligible cost, and drained the vaults.

Source: https://rekt.news/drift-protocol-rekt/

## 3. Pattern

**Key or signer compromise** (social engineering of multisig holders) combined with **missing operational security controls** (no timelock on admin actions).

Vulnerable shape in pseudocode:
```
// Admin multisig: 2-of-5, no timelock
function executeAdminAction(bytes calldata action) external {
    require(multisig.checkSignatures(action, 2)); // any 2 of 5
    _executeImmediately(action); // NO delay, NO veto window
}
```
The attacker obtained pre-signed durable-nonce transactions from two compromised signers. Because there was no timelock, those signatures were sufficient to transfer full admin control instantly. The admin could then create collateral markets with arbitrary parameters, deposit a near-worthless token at an attacker-controlled oracle price, and borrow all vault assets.

Source: https://rekt.news/drift-protocol-rekt/

## 4. The check that would have caught it

**Check 1 — Timelock on admin actions:** Every admin action that can move or rehypothecate user funds must pass through a timelock with a minimum delay (e.g. 12–24 hours) and an emergency pause that any council member can trigger. A review rule: "Can any N-of-M signers move funds instantly? If yes, the governance design is incomplete." Jupiter Lend (4/7, 12h timelock) and Kamino (5/10, 12h timelock) already followed this pattern at the time.

**Check 2 — Invariant test on admin capabilities:** An invariant test that asserts "no single admin transaction, nor any sequence of admin transactions within a 24-hour window, can reduce total vault TVL by more than N% without a timelock expiry event." Fuzz the admin action space — create markets, update oracles, change parameters — and verify the invariant holds in a mainnet-fork simulation.

Source for comparator protocols: https://rekt.news/drift-protocol-rekt/

## 5. Sources

- **Primary:** https://rekt.news/drift-protocol-rekt/ — comprehensive post-mortem covering the timeline, root cause, technical mechanism, fund tracing, and governance comparison. All facts above are drawn from this article, which itself cites Drift's public statements, ZachXBT's on-chain analysis, and statements from Hayden Adams and Taylor Monahan.
- **Not accessible at time of writing:** Drift's own post-mortem on Medium (HTTP 403), Drift docs (redirects to velocity.exchange, HTTP 500), and security-firm analyses from BlockSec, SlowMist, CertiK, Halborn, Verichains, and QuillAudits (HTTP 403/404). These were not reachable from this environment and their findings could not be cross-referenced.