Drift Protocol: $285M Drained After Multisig Signers Were Compromised
Two signers, one admin key, one empty vault.
On 1 April 2026, attackers socially engineered two of the five signers on Drift Protocol's Security Council multisig (a Squads multisig) and got them to pre-sign transactions using Solana durable nonces. A zero-timelock migration pushed on 27 March made the handover easier. With admin control in hand, the attacker listed a worthless token called CarbonVote Token (CVT) — seeded with roughly $500 of liquidity — as collateral, raised withdrawal limits, and drained real assets. Drift says no program or smart-contract bug was exploited: the vault, the code, the chain all worked exactly as designed. The keys controlling them didn't. BlockSec and Chainalysis put the loss at about $285.3M / $285M; Drift's own 16 April recovery update cites $295.7M in assets taken. TRM Labs and Elliptic attribute the attack to North Korea; Chainalysis calls it "preliminary indicators" only.
Case File Update
Removed Realms governance as the attack path; root cause clarified (compromised multisig signers); sources replaced.
The Scheme
This was not a smart-contract exploit and it did not run through Realms governance. The attacker socially engineered two of the five signers on Drift's Security Council multisig (built on Squads) into pre-signing transactions using Solana's durable-nonce feature, which lets a signed transaction sit ready to broadcast later. A zero-timelock migration rolled out on 27 March removed the delay that would normally have given the team a window to notice and react. Once the attacker held effective admin control, the actual trick was simple: list a near-worthless token, CarbonVote Token (CVT) — with about $500 of seeded liquidity — as accepted collateral, then raise withdrawal limits and pull out real USDC and SOL.
The fake token wasn't the exploit. It was the excuse the admin keys needed.
Compromised Keys, Not A Broken Contract
Drift's Security Council multisig required agreement from signers to approve privileged actions — in principle, a safeguard against any single point of failure. In practice, the attacker didn't need to break Drift's code at all. They needed two of five people to sign something they shouldn't have.
Durable nonces on Solana let a transaction be signed in advance and submitted whenever the holder chooses, instead of expiring quickly like a normal transaction. Reporting indicates the attacker used pre-signed transactions obtained this way from the compromised signers, giving them a window to act without needing the signers present at the moment of execution.
A migration completed on 27 March removed a timelock that would otherwise have delayed privileged changes, including collateral-listing changes, from taking effect. BlockSec's writeup frames the incident as a multisig governance compromise enabled by durable-nonce misuse, not a flaw in Drift's trading or vault logic.
Drift's own position is blunt: the code worked. The people holding the keys were the attack surface.
Why Listing A Fake Token As Collateral Was The Payout Step, Not The Root Cause
Once an attacker holds admin-level control over a protocol's parameters, the fastest way to extract real value is often to manufacture fake collateral and borrow or withdraw against it. That's what happened here: CarbonVote Token (CVT), a token with essentially no real liquidity (about $500 seeded), was listed as if it were legitimate collateral.
With CVT accepted and withdrawal limits raised, the attacker could draw real USDC and SOL out of the vault against collateral that was worth almost nothing. The fake token is the detail that made headlines, but it only worked because the admin controls that should have blocked a worthless listing had already been seized.
Root-cause distinction matters here: this was a privileged-access and social-engineering incident, not a bug in Drift's smart contracts, and not an exploit of Realms or any on-chain governance-voting mechanism. Multiple post-incident writeups (BlockSec, Chainalysis, Halborn) converge on compromised multisig signers as the cause.
A worthless token can only become collateral if someone with the authority to approve it says yes. Here, that someone was compromised.
Vocabulary Decoded: What Actually Failed
Terms from the reporting on this incident, and what they mean in plain language:
"Security Council Multisig"
What it sounds like:
A group of trusted signers who must jointly approve sensitive protocol changes, so no single compromised person can act alone.
What actually happened:
Two of the five signers were socially engineered into pre-signing transactions. The multisig's safety depends on the signers resisting manipulation — and in this case, two did not.
"Durable Nonce"
What it sounds like:
A Solana feature that lets a signed transaction remain valid for later submission instead of expiring within seconds, useful for legitimate multisig coordination across time zones.
What actually happened:
The same feature let the attacker obtain pre-signed approvals from compromised signers and hold them until ready to execute, without needing the signers present or aware at that exact moment.
"CarbonVote Token (CVT) Listed As Collateral"
What it sounds like:
A protocol adding a new asset that users can deposit as collateral for borrowing or leverage.
What actually happened:
CVT had roughly $500 of real liquidity behind it. It was listed as collateral only because the attacker already controlled the admin levers that approve new collateral types — the listing was the withdrawal mechanism, not a market event.
None of these three things is a smart-contract bug. All three are what happens when privileged access changes hands quietly.
How Compromised Signers Turned Into A $285M Drain
Based on BlockSec, Chainalysis, Halborn and Drift's own recovery update, the sequence runs through five stages — none of which required finding a flaw in Drift's code.
Step 1: A Zero-Timelock Migration (27 March)
A migration completed on 27 March 2026 removed a timelock that would have delayed privileged parameter changes from taking effect, shortening the window the team would otherwise have had to notice and react to something going wrong.
Timelocks exist so a bad decision — or a stolen signature — has to sit in public view before it bites. Removing one removes that warning window.
Step 2: Signers Are Socially Engineered
Two of the five signers on Drift's Security Council multisig (built on Squads) were socially engineered into pre-signing transactions using Solana's durable-nonce mechanism.
A five-person multisig is only as strong as its weakest two conversations.
Step 3: Admin Control Is Taken
With pre-signed transactions in hand, the attacker executed changes that handed them effective admin control over protocol parameters, including which assets could be listed as collateral.
This is the step Drift says did not involve any program or contract bug — the contracts did exactly what a validly-signed admin instruction told them to do.
Step 4: Worthless CVT Is Listed As Collateral
The attacker listed CarbonVote Token (CVT) — backed by about $500 of seeded liquidity — as accepted collateral, then raised withdrawal limits.
The fake token didn't need to fool a market. It only needed to fool one set of now-compromised admin controls.
Step 5: Real Assets Drained
Using the fabricated collateral and raised limits, the attacker withdrew real USDC and SOL. Drift's recovery update puts total assets taken at $295.7M; BlockSec and Chainalysis independently estimate about $285.3M / $285M. Rekt reports the withdrawal phase itself took as little as 128 seconds, with the wider incident window cited at about 12 minutes.
Minutes, not hours. Once the admin keys are gone, speed stops being the attacker's problem.
Timeline: From Migration To Drained Vault
Reconstructed from BlockSec's incident writeup, Chainalysis, Halborn, CryptoTimes and Drift's own recovery update:
27 March 2026: Zero-Timelock Migration
Drift completes a migration that removes a timelock protecting privileged parameter changes, including collateral listings and withdrawal-limit adjustments.
BlockSec's writeup identifies this migration as a key enabling condition: without a timelock, a privileged change could take effect immediately rather than sitting exposed to review.
Before 1 April: Signers Compromised
Two of the five Security Council multisig signers are socially engineered and pre-sign transactions using Solana durable nonces, which the attacker can later submit on their own schedule.
TRM Labs and Elliptic attribute the operation to North Korea–linked actors; Chainalysis describes the attribution as 'preliminary indicators' rather than confirmed.
1 April 2026: Admin Control Seized, CVT Listed
The attacker executes the pre-signed transactions, gains admin control, and lists CarbonVote Token (CVT) — about $500 of real liquidity — as accepted collateral.
Drift states explicitly that no program or smart-contract flaw was involved: the vault and code behaved exactly as instructed by validly-signed admin transactions.
1 April 2026: Withdrawal Limits Raised, Vault Drained
With CVT accepted as collateral and limits raised, the attacker withdraws real USDC and SOL. Rekt reports the withdrawal itself took about 128 seconds; the broader incident window is cited at roughly 12 minutes.
BlockSec and Chainalysis estimate the loss at about $285.3M–$285M. Drift's 16 April recovery update instead reports $295.7M in total assets taken — both figures come from named, published sources.
16 April 2026: Drift Publishes Recovery Update
Drift publishes an incident recovery update addressing the loss and its response, citing $295.7M in assets taken.
Halborn and CryptoTimes both describe the root cause as compromised multisig signers rather than any flaw in Drift's deployed programs.
A removed timelock, two compromised signers, one worthless token listed as collateral. The $285M–$295.7M loss was the result of those three things, in that order.
What The Public Record Shows
Key facts as reported by BlockSec, Chainalysis, Drift and other named sources — see Sources & Citations below for the full list:
BlockSec: "Drift Protocol Incident: Multisig Governance Compromise via Durable Nonce Exploitation." Two of five Security Council signers were socially engineered into pre-signing transactions using Solana durable nonces.
In plain terms: the attacker didn't crack Drift's code — they got two trusted people to sign something that should never have been signed.
A zero-timelock migration on 27 March removed the review window that might otherwise have caught this before it reached the vault.
The attacker used seized admin control to list CarbonVote Token (CVT) — about $500 of seeded liquidity — as accepted collateral, then raised withdrawal limits.
The fake token wasn't the hack. It was how the attacker converted stolen admin access into withdrawable real assets.
Drift states that no program or smart-contract bug was exploited; the vault logic executed exactly as instructed by validly-signed admin transactions.
BlockSec and Chainalysis estimate the loss at about $285.3M / $285M. Drift's own 16 April recovery update cites $295.7M in assets taken. Rekt reports the withdrawal phase took about 128 seconds, inside a roughly 12-minute incident window.
Two credible estimates, two different numbers, both published by named sources — we report both rather than pick one.
TRM Labs and Elliptic attribute the attack to North Korea; Chainalysis calls the attribution 'preliminary indicators' only, which is a meaningfully weaker claim and is stated as such here.
What The Post-Incident Reports Point To
- •No timelock on privileged changes — The 27 March migration removed a timelock that would have delayed collateral-listing and withdrawal-limit changes, per BlockSec's incident writeup.
- •Multisig signers are a social-engineering target — A five-signer multisig is only as resistant as its weakest signer under sustained social pressure; two of five were compromised here.
- •Durable nonces can be misused for delayed execution — A legitimate Solana feature for flexible transaction timing was used to hold pre-signed approvals until the attacker was ready to act.
- •Collateral listings need independent review — A token with about $500 of real liquidity should never clear a collateral listing; it did here because the approval authority itself was compromised.
- •Attribution is still being refined — TRM Labs and Elliptic point to North Korea; Chainalysis frames its own attribution as preliminary. Treat the North Korea link as reported, not as independently confirmed by every cited source.
None of these points describe a smart-contract bug. All of them describe privileged-access and process failures.
The Numbers, As Reported
Two credible loss figures exist; both are published by named sources, so both are shown:
$285.3M / $285M — BlockSec & Chainalysis Estimate
BlockSec's and Chainalysis's independent post-incident analyses put the loss in this range.
$295.7M — Drift's Own Recovery Update (16 April)
Drift's own 16 April update describes $295.7M in total assets taken, a figure somewhat higher than outside estimates — both are reported here rather than reconciled into one number.
~$500 — Seeded Liquidity Behind CVT
The CarbonVote Token used as fake collateral had roughly $500 of real liquidity behind it at the time it was listed.
~12 minutes (128 seconds for the withdrawal itself)
Rekt reports the withdrawal phase took about 128 seconds; the wider incident window, from compromise to drained vault, is cited at roughly 12 minutes.
Why Multisig Compromises Keep Happening
Drift is one entry in a pattern of incidents where the attacker targets the people holding keys rather than the code itself:
Multisigs Reduce Risk — They Don't Remove It
A multisig requiring multiple signers is meant to prevent any single compromised party from acting alone. It does not prevent a coordinated social-engineering campaign against two or more of those people at once.
The math of 'needs 2 of 5' only works if an attacker can't get to 2 of 5. Assume they can try.
Timelocks Are A Second Line Of Defence
Even if signers are compromised, a timelock gives the rest of the team — and outside watchers — a window to notice a suspicious pending change before it executes. Removing that window, as happened here on 27 March, removes the safety net along with it.
A migration that quietly removes a timelock is itself worth treating as a security event.
A Fake Collateral Listing Is A Symptom, Not The Disease
Once admin control is compromised, listing a worthless token as collateral is one of several ways to extract value. The lesson isn't 'watch for fake tokens' — it's 'protect the admin keys that could approve one.'
If you're auditing a protocol's risk, start with who can change the collateral list, not with which tokens are currently listed.
Who Was Affected
What's publicly confirmed about the impact, and what remains unclear:
Drift's Vault And Users
Real USDC and SOL held in Drift's vault as collateral for users were drained. Drift's 16 April update addresses its recovery plan directly; the specific breakdown of user-level impact has not been independently confirmed beyond that update.
DRIFT Token Holders
Market reaction following a loss of this size is well documented in general for DeFi incidents, but we are not stating a specific price-impact figure for DRIFT here, as it is not confirmed in the sources reviewed.
Solana DeFi, By Association
Large incidents on major Solana protocols typically draw attention to the wider ecosystem's risk controls; we are not citing a specific TVL-impact number for this case, as none is confirmed in the sources listed.
Drift's Recovery Commitment
Drift published an incident recovery update on 16 April 2026 addressing the loss. Details of any reimbursement plan should be verified directly against that update rather than summarised secondhand.
The headline number — $285M–$295.7M — is the confirmed core of this story. Claims beyond that, including specific victim breakdowns or market-reaction percentages, are not stated here unless a named source backs them.
How To Protect Yourself From The Next Multisig Compromise
This was a privileged-access failure, not a user-side mistake — but the pattern recurs, and these habits reduce exposure:
- Rule 1: Check whether a protocol's admin changes go through a timelock If privileged parameter changes — including new collateral listings — can take effect instantly, there's no window for anyone to catch a compromised signature before it executes.
- Rule 2: Understand that multisigs are a social-engineering target A multisig's security depends on every signer resisting manipulation, not just on the number of required signatures. Ask how a protocol trains and verifies its signers.
- Rule 3: Watch for sudden collateral-list changes A new or obscure token suddenly accepted as collateral, especially one with minimal real liquidity, is worth treating as a red flag regardless of the stated reason.
- Rule 4: Follow official post-incident updates directly Go to the protocol's own recovery updates (as Drift published on 16 April) rather than relying on secondhand summaries, especially for loss figures and remediation commitments.
- Rule 5: Run any unfamiliar DeFi link or contract through our free Scam Detector If a link, token, or 'recovery agent' message related to this or any incident feels off, check it before you interact with it.
Got a Suspicious Message?
Use our AI-powered detector to analyze potential scams instantly.
Key Takeaways
- 1.This was a multisig governance compromise, not a smart-contract exploit. Two of five Security Council signers (Squads multisig) were socially engineered into pre-signing transactions using Solana durable nonces.
- 2.A zero-timelock migration on 27 March 2026 removed the review window that might otherwise have caught the compromise before funds moved.
- 3.Once the attacker had admin control, they listed a near-worthless token, CarbonVote Token (CVT) — about $500 of seeded liquidity — as collateral, then raised withdrawal limits to drain real assets. Realms governance was not part of the attack path.
- 4.Loss estimates: BlockSec and Chainalysis put it at about $285.3M / $285M; Drift's own 16 April recovery update cites $295.7M in assets taken. Rekt reports the withdrawal itself took about 128 seconds inside a roughly 12-minute window.
- 5.TRM Labs and Elliptic attribute the attack to North Korea; Chainalysis describes this only as 'preliminary indicators.'
- 6.Before trusting any DeFi protocol's governance: ask whether privileged changes go through a timelock, how multisig signers are protected from social engineering, and whether collateral listings get independent review.
“Twelve minutes. $285M–$295.7M. Two signatures that should never have happened.”
Not a broken contract. A broken set of keys.
Frequently Asked Questions
Sources & Citations
Research for this investigation compiled from publicly available blockchain data, security reports, and community documentation.
TRM Labs · 2 Apr 2026
TRM Labs · 2 Apr 2026
BlockSec · 1 Apr 2026
BlockSec · 1 Apr 2026
Chainalysis · 1 Apr 2026
Chainalysis · 2026-04
BleepingComputer · 2 Apr 2026
BleepingComputer · 2 Apr 2026
Halborn · Date not published or not verified
Halborn · Date not published or not verified
CryptoTimes · 3 Apr 2026
CryptoTimes · 3 Apr 2026
Verification: On-chain references: none published for this case.
Methodology: Every case needs at least two independent sources before publication, plus verifiable on-chain evidence whenever a public transaction trail exists. Full standards: /methodology
Legal notice: This assessment is based on publicly available data, including on-chain records, official statements and reported incidents. It is journalistic and educational analysis, not legal advice, an accusation of criminal conduct or a court finding. Named companies, projects, domains, wallets and individuals are described as reported by the cited sources; a company name may appear because fraudsters impersonated it, not because the company did anything wrong. If you believe something is inaccurate or out of date, write to cryptostrapon@pm.me and we will correct it and log the change. Editorial policy
More Scam Warnings
Continue learning about crypto threats
KelpDAO + LayerZero: $292M Lost to a 1-of-1 DVN
Bridge Exploit • 2026-06-09
A compromised LayerZero DVN released 116,500 rsETH (~$292M) from KelpDAO's bridge. LayerZero and Kelp dispute who chose the 1-of-1 setup.
Hyperbridge $1.2B Fake DOT: The Unchecked Mint Function
Bridge Exploit • 2026-05-28
A missing access-control modifier let an attacker mint $1.2B of unbacked DOT on Ethereum via Hyperbridge. Full kill chain plus $237k Uniswap dump.
EIP-7702 Drainer: One Signature Empties a Wallet
Smart Contract Exploit • 2026-05-31
One signature on a Pectra EIP-7702 delegation hands over your whole balance. The exact prompt you will see, the 0x04 payload, and how to revoke it.