Solana Foundation Chair: Drift Attack Stemmed From Human Error, Not Smart Contract

Drift, a decentralized finance project on the Solana blockchain, experienced a significant exploit that drained nearly $300 million in digital assets. The attacker exploited a new market on Drift that allowed users to borrow other cryptocurrencies against an illiquid token called CVT. Some of the stolen assets were converted into USDC and moved to Ethereum.

Drift confirmed an active attack and suspended deposits and withdrawals to prevent further losses. The attacker likely compromised an admin signer key, enabling them to drain multiple Drift vaults. The stolen assets included Solana, USDC, cbBTC, and wBTC.

On-chain data showed more than $250 million moving from Drift to an interim wallet before being split across multiple addresses. The attacker converted the stolen funds into USDC through Jupiter and then bridged those stablecoins to the Ethereum network to purchase Ethereum.

How Did the Exploit Occur?

The attack involved a sophisticated method of gaining control of Drift's admin system. Attackers needed approval from only two out of five key signers to execute unauthorized actions. They used pre-approved transactions to manipulate market prices and disable withdrawal protections.

The exploit highlighted vulnerabilities in the Drift Protocol's governance and key management. Analysts suggested that the breach was a result of exposed private keys and insufficient security measures. The incident has raised concerns about the speed at which large sums can be drained from DeFi platforms.

What Are the Implications for the Market?

The DRIFT token dropped more than 20% after the exploit was reported. The token was trading at around $0.05, a sharp decline from its previous value. The attack prompted a broader sell-off in the Solana DeFi ecosystem, with trading activity, open interest, and total value locked all declining.

Traders pulled back across Solana-based DeFi platforms following the exploit. The incident sent Solana's native token into a period of volatility as market participants reassessed risk. Security experts emphasized the need for stronger governance practices and improved smart contract audits to prevent similar attacks in the future.