driftprotocol

On April 1, 2026, Drift Protocol, the largest perpetual futures exchange on Solana, experienced a significant security breach, resulting in the theft of approximately $285 million. This incident marks the largest DeFi hack of 2026 and the second-largest in Solana's history. Unlike typical DeFi exploits that target smart contract vulnerabilities, this breach was a sophisticated administrative takeover attributed to North Korean state-sponsored actors.

▎How the Breach Occurred

The attack involved a multi-week execution strategy that combined social engineering with technical manipulation of Solana's infrastructure:
• Durable Nonces Manipulation: Attackers tricked members of Drift’s Security Council into pre-signing transactions, allowing them to store valid signatures for later use.
• Admin Takeover: Using these signatures, the hackers gained unauthorized control over the protocol’s multi-signature administrative powers.
• Fake Collateral: They whitelisted a fictitious asset called CarbonVote Token (CVT) and manipulated Drift's oracles to recognize it as valuable collateral.
• The Drain: The attackers deposited 500 million CVT and used it to withdraw $285 million in real assets like USDC, SOL, and ETH.

▎Impact and Current Status

The exploit was executed rapidly, draining primary vaults in approximately 10 seconds. Key impacts include:
• Total Loss: Around $285 - $286 million.
• TVL Drop: Total value locked fell from ~$550 million to under $250 million (over 50% loss).
• Protocol Status: Deposits and withdrawals were immediately suspended.

▎Recovery and Investigation

Drift is collaborating with law enforcement and exchanges to freeze stolen assets, while analysis indicates that the attackers began laundering the funds shortly after the breach. Users are advised to monitor Drift’s official channels for updates on recovery efforts and potential reimbursement plans for affected users.$SOL #DriftProtocol #breach #solana

🇰🇵北朝鮮に関連するグループラザルスグループは暗号の悪用を支配し続けています — 合計損害は現在$3Bを超えています。

主要な攻撃：

🔸 2017 — Bithumb ($7M, フィッシング)
🔸 2018 — Coincheck ($625M, マルウェア)
🔸 2020 — KuCoin ($280M, 認証情報の盗難)
🔸 2022 — Ronin Network ($625M, 偽の求人)
🔸 2022 — Horizon Bridge ($100M, プライベートキーの悪用)
🔸 2023 — Atomic Wallet / Alphapo / CoinsPaid / Stake / CoinEx ($292M 合計)
🔸 2024 — WazirX ($235M, マルチシグの侵害)
🔸 2025 — Bybit ($1.5B, マルチシグ)

2026年のエイプリルフールの日に北朝鮮の国家ハッカーがDrift Protocolから2億8500万ドルを盗んだ物語は、悪意のあるコードの行から始まるわけではありません。それは2025年の秋のあるクリプト会議で、握手から始まります。
それが、この年で最も不安を煽るDeFiハッキングであり、暗号の歴史の中で最も洗練されたソーシャルエンジニアリング作戦の可能性を持つ理由です。攻撃者は、UNC4736として知られる北朝鮮の国家グループに中程度から高い確信で帰属されており（AppleJeusまたはCitrine Sleetとも呼ばれています）、力任せに侵入したわけではありません。彼らはDriftのチーム内で本物の人間関係を築くのに6ヶ月を費やしました。