Drift Protocol: No Evidence of Mnemonic Theft, Highly Sophisticated Attack, Weeks-Long Preparation

April 2: Drift Protocol announced via Twitter that a threat actor executed a novel attack leveraging a durable nonce to gain unauthorized access, quickly seizing control of the Drift Security Council. The attack was highly sophisticated, prepared over several weeks, and involved pre-signed transactions for durable nonce accounts to delay execution. Ongoing investigation findings indicate the incident did not stem from vulnerabilities in Drift Protocol or its smart contracts; there is no evidence of mnemonic phrase theft. Instead, the attacker gained access through unauthorized or forged transaction approvals—potentially involving social engineering. The attack drained approximately $280 million in protocol funds. Affected assets include all borrowing, vault deposits, and trading funds. DSOL (assets not deposited in Drift, including those staked to Drift validators) and the insurance fund remain unaffected, with the latter tapped to provide protection. As a precaution, all remaining protocol functionalities have been frozen, and the multisig has been updated to remove compromised wallets.