SlowMist: The multi-signature mechanism was modified more than a week before the Drift theft, followed by an administrator privilege leak.

ZkProver · 2026-04-02T02:16:16+00:00

SlowMist analysis indicates that Drift adjusted its multi-signature mechanism one week before the theft event and did not set a time lock, allowing the attacker to gain admin privileges, forge tokens, and manipulate oracles. Ultimately, approximately 105,969 ETH (about $226 million) was transferred from the liquidity pool. The fund flow is still being tracked.

ZkProver

2026-04-02 02:16:16

Abstract generation in progress

ChainCatcher report: SlowMist’s post analyzing the Drift theft incident points out that one week before the attack, Drift changed its multisig mechanism to “2/5” (1 old signer + 4 new signers) and did not set a timelock. The attackers then obtained admin privileges, forged CVT tokens, manipulated the oracle, disabled security mechanisms, and transferred high-value assets out of the treasury.

At present, the stolen funds have been largely consolidated to an Ethereum address, totaling about 105,969 ETH (approximately $226 million). SlowMist says that the related fund flows are still being actively traced.

DRIFT-40.31%

ETH-3.93%

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.

1 Likes