The DeFi lending protocol Drift was hacked for over $200 million in just 10 seconds, affecting more than 15 projects

By: rootdata|2026/04/03 03:45:01

Author: Gu Yu, ChainCatcher

Around 1 AM today, a massive theft incident occurred again in the DeFi space, where the Solana lending protocol Drift was attacked by hackers, resulting in over $220 million in user assets being stolen within ten seconds.

After the incident, the Drift token dropped over 40% in a short time, with the current FDV around $44 million. Due to the involvement of many assets in the Solana ecosystem, tokens in the Solana space such as SOL and JUP experienced varying degrees of abnormal declines.

Previously, Drift was one of the largest lending protocols in the Solana ecosystem. According to RootData, the protocol has raised over $52 million, with investors including top VCs like Multicoin Capital, Polychain, Robot Ventures, Blockchain Capital, Ethereal Ventures, and Jump Capital.

According to public analysis, this theft of Drift is closely related to the illegal acquisition of control over the multi-signature address, combined with common attack methods such as governance attacks and oracle attacks. The attacker used a single signature key to complete all operations in one transaction: creating a fake market, manipulating the oracle, and lifting withdrawal restrictions. Among them, the possibility of insider involvement in the leakage of the multi-signature address private key exists.

The frequently seen attack methods, along with the project's weak preventive measures, once again expose the vulnerabilities in the DeFi space. Based on a tweet and related interpretations from Chaos Labs founder Omer Goldberg, here is a detailed analysis of the theft process:

The initial signs of the incident occurred a week ago when Drift migrated the management authority of the protocol from an old multi-signature wallet to a new multi-signature wallet. This new wallet was created by one of the signers from the old multi-signature wallet, but that signer did not add themselves to the new multi-signature wallet.

The attacker seized this vulnerability, first initiating a proposal in the old multi-signature to transfer Drift's administrative rights to a new wallet (controlled by the attacker).

The new multi-signature was set up with five signers, only one of whom was from the old wallet, while the other four were entirely new. The rules were extremely lenient: only 2 out of 5 needed to agree (meaning only 2 signatures were enough), and there was a 0-second time lock (the proposal was executed immediately without any waiting period).

In the early hours of today, the only remaining old signer proposed in the new multi-signature: "Change Drift's administrative rights to the wallet truly controlled by the attacker."

Seconds later, another new signer immediately co-signed, easily reaching the ⅖ threshold. Because there was no time lock, the proposal was executed instantly, granting the attacker complete administrative rights.

Subsequently, the attacker immediately used their authority to create a CVT spot market in the Drift protocol, with a total supply of about 750 million tokens, of which the attacker held 600 million. The attacker then used their controlled SwitchboardOnDemand oracle and configured Drift to read from that oracle.

After completing the operation, the attacker raised the price of the previously nearly worthless CVT token through 20 transactions, making the 600 million CVT they deposited appear to be worth hundreds of millions of dollars according to the oracle. As a result, the attacker borrowed assets worth about $220 - $280 million, including 41.72 million JLP (Jupiter LP token, worth about $155 million), 51.61 million USDC, and 164 cbBTC (worth about $11.29 million).

The modular structure of DeFi was once seen as the greatest advantage of the field, but now this advantage has also transmitted risks to other DeFi protocols integrated into the Drift lending market in the Solana space like a domino effect.

Jupiter is the biggest victim affected by this security incident, with the most stolen JLP being the core LP asset of the Jupiter perpetual contract market. This theft will significantly reduce the liquidity of the Jupiter perpetual contract market and trigger panic withdrawals and a decline in the JUP token, among other chain reactions.

In addition, over 15 DeFi protocols including Perena, Project 0, Exponent, Carrot, Ranger, PiggyBank, Reflect, Elemental, Neutral Trade, Pyra, Fuse, and XPlace have confirmed varying degrees of impact from the Drift theft incident, with some withdrawal functions already suspended.

However, among all security incidents, the most affected are still the users, as the continuous hacking events repeatedly shake users' confidence in DeFi.

"Today I'm not doing anything else, I'm withdrawing all funds from all old projects on-chain, and for new projects, unless I know them particularly well, I'm not investing either. It's a tumultuous time, don't test human nature." After losing over $6,000 in this incident, well-known KOL Tu Ao Da Shi posted this statement.

-- Price

On June 9, The Kobeissi Letter, citing Goldman Sachs data, reported that global investors are selling South Korean stocks at an unusually rapid pace. In the latest trading session, foreign investors sold about $801 million worth of Kospi constituent stocks again; total foreign outflows last week reached about $10 billion, and the market has been in net foreign selling on nearly every trading day over the past month. According to the data cited in the report, foreign investors have sold about $75 billion worth of South Korean stocks so far this year. Meanwhile, South Korean retail and institutional investors together recorded roughly $69 billion in net buying over the same period, suggesting that the market’s main buying support has come from domestic capital rather than returning overseas funds. The information currently disclosed still mainly comes from The Kobeissi Letter’s retelling and Goldman Sachs data summaries, while public details on the statistical period and the specific definition of “selling” remain relatively limited.

Fortune Warns of Strategy’s Financing Structure Risks as Bitcoin Premium Narrows

Fortune warned that Strategy’s Bitcoin treasury model faces growing financing risks as MSTR’s net asset premium narrows and preferred stock dividend pressure increases.

Ferrari Challenge Le Mans: Carl Moon to Dominate in WEEX Livery

The art of absolute control. Inside Carl Moon’s Ferrari 296 Challenge quest at Le Mans, taming the storm together with the official WEEX livery.

Sahara AI Responds to SAHARA’s Sharp Drop: No Contract or Product Security Issues Found, Internal Investigation Underway

Sahara AI responded to SAHARA’s 60% price drop, saying no token contract or product security issues have been found and an internal investigation is underway.

WEEX Deposit/Withdrawal Dynamic Island: Your Asset Status, Always in Sight

WEEX introduces Deposit and Withdrawal Info on Dynamic Island for iOS. See fund transfer progress on your dynamic island, lock screen, or while using other apps. No more guessing. No more refreshing.

Scaling Crypto Derivatives: The Digital Asset Infrastructure Behind High-Volume Trading

In the fast-moving digital asset ecosystem, derivatives platforms face an extreme architectural test. High-leverage futures markets demand more than just standard security—they require absolute operational precision, zero-latency matching engines, and ironclad structural scalability, all while navigating intense market volatility.

As global platforms scale to meet these demands, the industry is shifting away from rigid, monolithic setups toward a more agile, "decoupled" infrastructure philosophy.

The Blueprint for High-Volume Copy Trading

For elite global exchanges like WEEX (founded in 2018), this architectural choice becomes critical when scaling high-volume retail features like social copy trading. When thousands of users automatically mirror the real-time strategies of elite traders simultaneously, it triggers sudden, monumental spikes in concurrent transactional volume.

To prevent execution latency or settlement bottlenecks during these peak volatility events, a platform's primary engine must remain entirely dedicated to risk management, copy-trade synchronization, and order matching.

The Architectural Rule: New-generation platforms must separate front-end user execution engines from heavy backend infrastructural overhead to eliminate operational friction.

By separating these layers, platforms can maintain complete sovereignty over their trading environments and user experiences while strategically aligning with institutional-grade infrastructure ecosystems. This strategic framework allows modern exchanges to leverage advanced Digital Asset Custody infrastructure such as Cobo’s behind the scenes, ensuring that backend wallet management scales elastically alongside trading spikes.

Capitalizing on Market Momentum and 400× Leverage

In a derivatives arena where platforms offer up to 400× leverage on perpetual contracts, capital efficiency and market agility are core business metrics. To capture market momentum, an exchange needs the ability to rapidly expand its asset offerings, supporting everything from legacy crypto assets to sudden, trending altcoins across a massive library of trading pairs.

Adopting a flexible, scalable Wallet-as-a-Service (WaaS) solution such as Cobo’s could completely rewrite the development timeline for high-growth exchanges. Instead of spending months of engineering capital building out custom backend wallet architectures for every new blockchain network, platforms can deploy localized infrastructure in days.

This agility allows platforms to instantly scale their listings to over a thousand trading pairs without compromising security or delaying time-to-market. It mirrors the exact operational advantages seen during high-velocity market events, similar to how advanced wallet infrastructure empowers platforms during sudden asset surges; allowing exchanges to pass that speed and liquidity directly to their global user base.

A Mature Foundation for Growth

The synergy between trusted infrastructure ecosystems and global trading platforms represents the natural evolution of a maturing crypto market. As WEEX continues to scale its global spot and derivatives offerings for over 6 million users, adopting robust backend paradigms proves that platforms no longer have to compromise between cutting-edge trading velocity and uncompromised structural security.

Get Paid to Onboard? Try WEEX’s New Homepage with Rewards for Registration, Deposit & Trade

WEEX just launched a brand new homepage and a 3-step new user onboarding guidance. Complete Registration → Deposit → Trade to earn exclusive rewards. Faster navigation, clear progress, and instant bonuses. Download the latest WEEX App to try it now.

WEEX Custom Layout: Build Your Perfect Trading Workspace in Seconds

WEEX introduces custom layout on futures trading page: left/right panel switch, hide/show core modules, full-screen focus, and one-click reset. Trade your way now.

Morning Report | BitMine increased its holdings by 126,971 ETH last week; trader Eugene announced his exit from the crypto market

Overview of Important Market Events on June 8th

Wang Chuan: How can one not feel anxious after the neighbor Old Wang made thirty times profit by investing in storage stocks? (Seven) - A quarter-century cycle