The most serious Defi hacking incident of 2026 has occurred‼️‼️
Drift Protocol announced on Twitter that the platform was hacked for 280 million USD, and this entire process was not due to a vulnerability in the project team or a contract error, but rather a six-month-long premeditation.
Token $DRIFT dropped from a high of 2.4 USD all the way down to a low of 0.03 USD. After the hack, investors FTX/Alameda sold 6.94 million DRIFT for about 320,000 USD through Wintermute, creating a direct chain reaction...
Let's review what happened:
1️⃣ The hacker disguised as a quantitative trading company in 2025 contacted the Drift team during a meeting and deposited 1 million USD at the end of 2025. They held multiple working meetings and offline meetings with the project team to build trust, conducting long-term social engineering infiltration.
2️⃣ The hacker began sharing code repositories and the TestFlight App, using malicious links in the code repository + TestFlight application to invade devices and obtain admin private keys, executing transfers and erasing traces thereafter.
3️⃣ On March 11, the hacker withdrew about 10 ETH from Tornado Cash as initial funds, signed a completely fictitious CarbonVote Token, and minted about 750 million tokens, injecting only about 500 USD in liquidity into Raydium. They created false price history through wash trading, leading Drift's oracle to mistakenly recognize CVT as valid collateral.
4️⃣ On March 23, multiple durable nonce accounts were created, two of which were related to members of the Drift Security Council's multi-signature. These pre-signed transactions appeared to be routine operations but concealed key authorizations that allowed subsequent delayed execution.
5️⃣ On March 25, Drift executed the planned migration of the Security Council multi-signature. The attacker quickly adapted to obtain enough signatures again under the new configuration, and the new multi-signature had no time lock set (timelock = 0 became the biggest loophole), allowing the attacker's main wallet to perform small tests.
6️⃣ On April 1, in less than 12 to 20 minutes, the attacker triggered 31 attacks using durable nonce pre-signed transactions, instantly obtaining admin rights of the Security Council, changing the admin key to lock the team out, and quickly exchanging funds through the Jupiter aggregator for USDC, then transferring large amounts of ETH to Ethereum via Wormhole / CCTP and other cross-chain transfers.
⭐️ This attack was not caused by a code bug, but rather by human + governance failure, social engineering + misleading pre-signing + zero-delay multi-signature, a deadly combination for this attack.
#DriftProtocol