Drift Protocol Suffers $285 Million Exploit in Largest DeFi Hack of 2026 as Analysts Point to North Korea
Attackers used Solana's durable nonce feature to hijack Drift's governance and drain $285 million in 12 minutes, with blockchain forensics firms linking the heist to North Korean operatives.
Overview
Drift Protocol, one of the largest decentralized finance platforms on the Solana blockchain, was exploited for approximately $285 million on April 1, 2026, in what has become the biggest DeFi hack of the year and the second-largest security incident in Solana’s history. The attack exploited a legitimate Solana transaction feature known as “durable nonces” to hijack the protocol’s governance in a matter of minutes, according to Bloomberg. Blockchain forensics firms have identified indicators consistent with North Korean state-sponsored hackers.
How the Attack Worked
The exploit centered on durable nonces, a Solana feature that allows transactions to be pre-signed and executed at a later time without expiring. According to CoinDesk, the attacker manipulated Drift’s Security Council into pre-approving transactions that would execute weeks after signing, at a time and in a context the signers never intended.
The operation was elaborate and multi-staged. According to TRM Labs, the attacker first created a token called CarbonVote Token (CVT), minting approximately 750 million units and seeding a small liquidity pool of roughly $500 on Raydium. Wash trading was used to build a price history near $1, which Drift’s oracles then treated as legitimate collateral worth hundreds of millions of dollars.
Between March 23 and March 30, the attacker created a series of durable nonce accounts containing pre-signed withdrawal transactions. On March 27, a Security Council migration eliminated timelock protections, according to TRM Labs. The final execution on April 1 completed 31 withdrawal transactions in approximately 12 minutes, draining three main vaults: the JLP Delta Neutral vault (approximately $155 million in JLP tokens), a SOL Super Staking vault, and a BTC Super Staking vault, as reported by Elliptic.
Drift confirmed the breach in a public statement, saying that “a malicious actor gained unauthorized access to Drift Protocol through a novel attack involving durable nonces, resulting in a rapid takeover of Drift’s Security Council administrative powers,” as reported by Fortune.
North Korean Attribution
Two blockchain forensics firms have pointed to North Korean involvement. Elliptic identified “multiple indicators suggesting that the exploit of Drift Protocol is linked to the Democratic People’s Republic of Korea,” based on on-chain behavior, laundering methodologies, and network-level indicators matching previous DPRK operations.
TRM Labs corroborated the assessment, noting that on-chain staging began on March 11 with a single withdrawal of 10 ETH from Tornado Cash. The funds began moving hours later at approximately 12:00 AM GMT on March 12 — or around 09:00 Pyongyang time — aligning with Korean Peninsula working hours.
If confirmed, the attack would add to a mounting record of North Korean cryptocurrency theft. According to Fortune, North Korean hackers stole approximately $2 billion in cryptocurrency during 2025 alone, representing roughly 60 percent of global digital asset theft that year. The largest single incident was the $1.5 billion Bybit hack.
Impact and Response
Drift immediately suspended all deposits and withdrawals following the discovery of the exploit, according to Bloomberg. The protocol’s total value locked collapsed from roughly $550 million to under $250 million, while the DRIFT token fell from approximately $0.072 to $0.055, as noted by Elliptic.
The stolen assets — including USDC, SOL, cbBTC, wBTC, and liquid staking tokens — were rapidly swapped to USDC via Solana decentralized exchanges, then bridged to Ethereum and converted to ETH, according to Elliptic. Drift said it was coordinating with “multiple security firms, cross-chain bridges and exchanges to contain the incident.”
Founded in 2021 by Cindy Leow and David Lu, Drift offered perpetual futures trading and had accumulated over $400 million in total deposits prior to the attack, as reported by Fortune.
What Remains Unclear
Several questions remain unanswered. The exact method by which the attacker obtained the initial access to manipulate the Security Council migration has not been publicly disclosed. Whether the social engineering targeted individual council members or exploited procedural weaknesses in the governance process is unknown. The full extent of potential fund recovery — and whether exchanges or bridge operators froze any of the stolen assets in transit — has not been confirmed.
The exploit is the second-largest in Solana’s history, behind only the $326 million Wormhole bridge hack in 2022, and underscores ongoing risks in DeFi governance models that rely on multisignature wallets and administrative privileges.