After Drift was hacked, DeFi finally started taking security seriously.

SnapshotBot · 2026-04-06T22:25:00+00:00

Ferrante's tweet reveals DeFi security issues, criticizing the industry's overemphasis on growth at the expense of risk. Market data shows that Solana's total value locked (TVL) has plummeted, affecting multiple protocols. The discussion is divided into two camps: builders focus on security budgets, while traders test market bottoms. Security is widely prioritized, and projects with clear audits should be given precedence. Long-term investors should adjust their strategies to avoid potential losses. The real opportunities lie with teams that prioritize security and disciplined traders who go long.

SnapshotBot

2026-04-06 22:25:00

Abstract generation in progress

A single tweet forces DeFi to confront its security problem

Ferrante’s latest comments are not the kind of canned talk like “we’ll definitely fix it next time.” He goes straight to the root cause: Drift was hacked, and at its core it reflects the industry’s pathological obsession with growth—financing pressure, investor expectations, community call sheets, and security always coming last. This tweet was reposted by more than a dozen big accounts, and it spread quickly.

ZachXBT has spent years tracking North Korea–linked hacking groups. His conclusion is that their methods aren’t particularly sophisticated; they mainly rely on persistent penetration plus social engineering, targeting teams’ basic competency gaps.
“National-level hackers are invincible” sounds scary, but it doesn’t match reality. Most protocols were hit because they made errors that were avoidable, not because they were crushed by some unbeatable expert.

Market data is saying the same thing: Solana’s total TVL dropped to $5.4 billion, a 15% decline. About 20 protocols were affected. But in derivatives, things aren’t nearly as bad—shorts were continuously liquidated, suggesting there has been someone to catch the sell orders.

TVL fell, but shorts are getting liquidated

After the tweet went out, discussions split into two camps:

Builders started seriously discussing how much to allocate to a “security budget.”
Traders started probing Solana’s floor: technical indicators are neutral; the RSI is oscillating between 43–52; the price of $81.47 is sitting below the moving averages; and the MACD is showing signals that it might be turning.

A few key data points:

Drift took the hardest hit: TVL plunged as much as 56% to $236 million. Perps trading volume was cut by 87%, and other protocols’ confidence in it is wavering too.
Solana derivatives: open interest is roughly $10 billion. The funding rate is slightly negative (-0.3%), and someone is quietly going long.
Liquidation situation: total liquidations were $8.1 million. Shorts were cleared for $6.2 million, while longs only $1.9 million—shorts were squeezed too tightly and paid the price.

The North Korea penetration cases that Taylor Monahan has compiled over the years (for example, the SushiSwap incident) do show that security issues are urgent. But “the national team is coming to wipe us out” is more like delayed panic over old news. The real opportunity lies in identifying teams that will start adjusting security practices immediately—these projects’ valuations should be repriced.

Who is speaking	What is the evidence	How the stance changes	My take
Security-focused Builders	Ferrante’s tweet is widely circulated; ZachXBT points to “neglect as the main cause”	The topic shifts from “patch after something happens” to “prevent in advance”; audits and internal controls start getting more attention	The teams that are now turning toward security are undervalued—prioritize Solana protocols with clear audit records
Growth-chasing teams	TVL drops across the board (Drift -56%, Solana -15%); about 20 protocols affected	The “board first, pay up later” model is exposed; VC may start to rigidly require security budget	Growth without security is the real vulnerability—don’t blame an “external strong enemy”
Shorting traders	SOL’s RSI/MACD is neutral; shorts dominate the $8.1 million liquidations	More of a short-term game, but the squeeze shows short positions are too concentrated	Shorts are late; lean toward contrarian positioning—watch for an L1 that can absorb drawdowns
Security researchers (Monahan, etc.)	Long-running penetration samples; average annual losses of about $285 million	Put “preventable” risks back on the table and suppress irrational selloffs	Penetration risk is real, but it can be managed; those who ignore it will suffer

How the tweet affects capital flows: The amplification effect turns “neglect is the main cause” into consensus. If audits keep up, TVL will likely stabilize. Based on a rough read from engagement volume, about 70% of people agree with this view.
Don’t trust the doomsday narrative: The claim that “Solana will be finished because of a chain reaction of explosions” doesn’t hold up. Shorts being squeezed repeatedly indicates the ecosystem is under strain but hasn’t broken.
How to locate it: Going long SOL perps is attractive; on the daily chart, Stochastic is oversold around 28, and the liquidation structure is more friendly to longs. This tweet could be a precursor to a security-driven valuation repricing.

Core view: If Builders truly start prioritizing security, they’ll move first. Treat these noise-making traders as noise—you might miss Solana’s repair rally. Long-term holders should rotate their exposure toward audited protocols; otherwise, what you’re holding is an embedded junior asset—the downside has been priced in, and the rebound hasn’t arrived yet.

Conclusion: You’re still in a “somewhat early” position. The real opportunities are in two groups: first, Builders who immediately increase spending on security and audits; second, Traders who go long on SOL with discipline. Long-term holders should shift positions to protocols with clear audits and internal controls, otherwise you’ll be left behind after the valuation repricing.

DRIFT-7.84%

SOL-3.38%

SUSHI-1.89%

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.

2 Likes