Drift Protocol: No Evidence of Seed Phrase Theft, Attack Highly Complex and Weeks in Preparation

On April 2, Drift Protocol tweeted that a malicious actor gained unauthorized access through a new type of attack involving durable nonce, quickly taking over the management of Drift’s security committee. This attack was highly complex and took weeks to prepare, including the use of durable nonce accounts to pre-sign transactions for delayed execution. Current investigations indicate that the incident was not due to vulnerabilities in the Drift program or smart contracts; there is no evidence of seed phrase theft; the attacker gained access through unauthorized or forged transaction approvals (possibly involving social engineering). The end result led to approximately $280 million in funds being withdrawn from the protocol. All lending, vault deposits, and trading funds were affected. DSOL (assets not deposited in Drift, including those staked to Drift validators) and insurance fund assets were not affected, with the latter being withdrawn for protection. As a precaution, all remaining protocol functions have been frozen, and the multi-signature has been updated to remove the compromised wallet.