Unlike traditional smart contract bugs, this attack exploited governance and human vulnerabilities. Hackers used social engineering to trick multisig signers into pre-approving malicious transactions, while also leveraging a Solana feature called “durable nonce” to execute them later. This was combined with the creation of a fake collateral token, which was falsely valued by oracles, allowing attackers to withdraw real assets at scale.

The breach occurred rapidly—within minutes, multiple vaults were drained, and funds were quickly converted and bridged to other blockchains, primarily Ethereum.
Investigations suggest links to North Korean hacking groups, highlighting the growing geopolitical dimension of crypto crime.
This incident exposes a critical weakness in