Drift, a decentralized trading protocol on Solana, confirmed a security breach with losses of at least $200 million, with some estimates reaching $270 million. The team issued an emergency alert early this morning, suspending all deposits and withdrawals as the attack unfolded.
"We detected abnormal activity on the protocol and are investigating," Drift posted on X. "Please do not deposit funds during the investigation. This is not an April Fools' joke. Stay vigilant and wait for further updates." The team is collaborating with multiple security firms, cross-chain bridges, and exchanges to contain the damage.
Second-Largest Security Incident on Solana
According to Rekt rankings, this attack is the second-largest security incident in Solana history, behind only the Wormhole bridge exploit of $326 million. On-chain data shows the hacker targeted several Drift pools, including JLP Delta Neutral, SOL Super Staking, and BTC Super Staking. A single transfer of 41.7 million JLP tokens accounted for roughly $155 million. Other stolen assets include SOL, USDC, cbBTC, and wBTC.
Following the news, Drift's native token $DRIFT crashed over 38% to around $0.04 at press time.
Hacker's Trail: From Solana to Ethereum
Arkham data indicates over $250 million moved from Drift to an intermediate wallet, then scattered to multiple addresses. Lookonchain tracked the hacker swapping stolen assets for USDC via Jupiter, bridging to Ethereum, and ultimately purchasing ETH. As of writing, the attacker had converted all stolen funds into 129,066 ETH, worth approximately $273 million.
Drift is an open-source DeFi platform known for perpetual futures trading and considered a core Solana infrastructure. DeFiLlama shows its TVL dropped from over $530 million before the incident to $252 million.
SolScan reveals the primary hacker wallet (starting with HkGz4Kmo) was created 9 days ago, traded on OKX and Jupiter, then remained dormant until April 1.
Drift stated it will release further updates via its official X account as investigations progress.