Drift Protocol Hacked for $270M in Solana’s Biggest DeFi Exploit

The attacker spent weeks preparing for the heist. Once the drain began, it took roughly 12 minutes. Nearly 20 protocol vaults were hit in rapid succession.

How the Drift Protocol Hack Unfolded

Three weeks before the attack, the exploiter minted a worthless token called CarbonVote Token (CVT). They created a low-liquidity pool on Raydium with just $500. Then they used wash trading to peg CVT at roughly $1.

During that same period, the attacker manipulated CVT’s price history on Switchboard, Drift’s oracle provider. This gave the fake token a credible on-chain price record.

On April 1, the attacker used what researchers describe as a compromised Drift admin key. They listed CVT as a new spot market on the protocol. They also raised withdrawal limits on USDC and other markets to 500 trillion, disabling all safety caps.

With those changes in place, the attacker deposited roughly 785 million CVT tokens as collateral. The oracle valued each token at about $1. That gave the attacker hundreds of millions in borrowing power against real assets.

What Was Stolen

The attacker drained funds from nearly 20 vaults. According to on-chain trackers, stolen assets include 66.4 million USDC and 42.7 million in JLP tokens. Large amounts of JitoSOL, wrapped BTC, wrapped ETH, and various stablecoins were also taken.

Additional tokens taken include JUP, RAY, MOODENG, and even FARTCOIN. Some trackers also report roughly 980,000 SOL among the stolen funds. Total vault liquidity dropped about 50% in under an hour.

The attacker quickly swapped stolen assets to USDC through Jupiter. From there, funds were bridged to Ethereum. On-chain data from Arkham shows the attacker has already purchased approximately 19,913 ETH worth over $42 million.

Src: PeckShieldAlert (X)

Admin Key Compromise Confirmed by Researchers

The Drift Protocol hack was not a smart-contract exploit in the traditional sense. Security analyst Vladimir S and multiple on-chain researchers concluded that a compromised admin signer was the critical enabler.

The compromised key allowed the attacker to push the CVT listing and withdrawal limit changes through governance without normal safeguards. According to researchers, different signature keys appeared across the transactions, pointing to a key management failure or multisig breach.

Some reports reference a new 2-of-5 multisig setup with zero timelock. That configuration, if accurate, would have allowed changes to take effect immediately without a waiting period for community review.

“Admin signer was compromised, or whoever controls it intentionally executed these changes,” Vladimir S stated. No evidence of an external smart-contract vulnerability exists. As one researcher put it, the attacker “walked in with the keys.”

Drift’s Official Response

Drift Protocol posted on X shortly after the attack began. “We are observing unusual activity on the protocol. We are currently investigating. Please do not deposit funds,” the team wrote. They added: “This is not an April Fools joke.”

A follow-up post confirmed the protocol was under active attack. Deposits and withdrawals were suspended. Drift said it was coordinating with multiple security firms, bridges, and exchanges to contain the incident.

PeckShield is among the security firms involved in the response. Phantom Wallet also moved quickly, blocking protocol access for Drift users.

Market Fallout and $DRIFT Token Crash

The $DRIFT token dropped 20% to 40% in the hours after the exploit. At last check, it was trading between $0.048 and $0.064, down roughly 30% to 35% over 24 hours.

Protocol TVL collapsed alongside the token price. Vault liquidity fell by half in under an hour. Solana’s broader DeFi ecosystem also felt the shock, with users rushing to revoke approvals and check exposure to Drift-related assets.

Loading chart...

Parallels to Past DeFi Exploits

The Drift Protocol hack shares clear similarities with the 2022 Mango Markets exploit on Solana. Avraham Eisenberg manipulated oracle prices to inflate collateral and drain $114 million from Mango’s pools. He was later arrested and convicted of fraud.

Admin key compromises have also driven some of DeFi’s largest losses. The 2022 Ronin Bridge hack cost $625 million. The Harmony Horizon Bridge exploit cost $100 million. Both resulted from compromised validator or signer keys.

The Drift exploit combines elements of both attack types. It used oracle manipulation to create fake collateral value, then relied on a compromised admin key to bypass protocol safeguards. That combination made it particularly devastating.

What Happens Next for Drift Protocol

As of April 2, 2026, the situation is still developing. Drift has not released a full postmortem or loss reconciliation. The protocol remains fully paused.

Drift is working with security firms and exchanges to freeze or track stolen funds on both Ethereum and Solana. Some assets may be recoverable if centralized exchanges or bridge operators cooperate. History suggests partial recovery at best for exploits involving admin key compromise.

For affected users, the advice is clear. Do not deposit into Drift. Revoke any remaining approvals and follow only the official @DriftProtocol account on X for updates.

The broader Solana DeFi ecosystem is now on high alert. Expect audits, multisig upgrades, and timelock discussions across major protocols in the weeks ahead. This exploit is a stark reminder that even battle-tested DeFi platforms remain vulnerable when admin key security fails.

This article is for informational purposes only and does not constitute financial advice. Always do your own research before making investment decisions.