🚨 DRIFT PROTOCOL: WHEN HUMAN TRUST BECOMES THE WEAK POINT 🚨
On April 1, 2026, Drift Protocol, the largest perpetual DEX on Solana, suffered a devastating attack of 285 million dollars in just 12 minutes.
With a TVL of about 550 million, more than half of the funds were quickly wiped out.
The crucial point?
No bug in the code: the system worked exactly as designed.
The attackers built access in about six months through a sophisticated social engineering operation. Pretending to be a legitimate trading company, they attended conferences, established technical relationships, and even invested over 1 million dollars to gain credibility.
Gradually, they compromised the devices of contributors related to governance by introducing malicious tools.
The real target was not the code, but the governance.
Drift used a 2-of-5 multisig without timelock, allowing immediate approvals.
The attackers exploited Solana's “durable nonces” to obtain valid signatures in advance, impossible to revoke.
At the same time, they created a fake token (CVT), artificially inflating its price through wash trading.
The oracle system, lacking strict controls, accepted that price as valid.
Once ready, they took control, inserted the token as collateral, and withdrew real assets.
In 31 transactions, they drained USDC, ETH, and SOL.
It was not a technological failure, but a human one: fragile governance, misplaced trust, and insufficient controls.
#BREAKING #Hack #DRIFT #solana