Drift Protocol Hacked for $285M: The Second Largest Exploit in Solana History

As a core decentralized exchange (DEX) for derivatives trading on the Solana blockchain, Drift Protocol recently suffered a severe security vulnerability attack. Over $285 million in crypto assets were stolen by hackers, causing a massive drop in its Total Value Locked (TVL). This incident has sparked widespread concern across the decentralized finance (DeFi) sector.

Incident Overview: Second Largest Solana Exploit

According to DefiLlama and on-chain security firms, the scale of the attack on Drift Protocol is massive. Initial estimates placed losses between $200 million and $270 million, but the latest on-chain data shows the actual stolen amount exceeds $285 million.

Before the attack, Drift Protocol's TVL reached $550 million, acting as the primary platform for perpetual contract trading in the Solana ecosystem. This hack wiped out more than 50% of the platform's liquidity. This is not only one of the largest on-chain crypto hacks to date but also the second-largest security event in the Solana ecosystem, trailing only the $326 million Wormhole bridge exploit in 2022.

Targeted Vaults and Affected Assets

The hacker had clear targets, directly attacking the core vaults with the deepest liquidity on the platform. The most severely affected vaults include JLP Delta Neutral, SOL Super Staking, and BTC Super Staking.

According to the SolScan block explorer, the largest abnormal transfer involved 41.7 million JLP tokens, worth about $155 million alone. Additionally, various high-value assets, including SOL, USDC, cbBTC, USDS, wBTC, and USDT, were also drained.

On-chain Tracking and Money Laundering Route

Security firms like Looksonchain have traced the attacker's on-chain footprint, revealing a carefully planned operation.

Attacker Profile The main attacker address (starting with HkGz4Kmo) was created eight days before the incident. Initially, it only interacted slightly with the OKX exchange and the Solana DEX aggregator Jupiter. It then remained completely dormant until waking up 18 hours before the exploit.

The Laundering Process To avoid having funds frozen by centralized entities, the hacker took multiple steps to launder the money:

1. The attacker first used Jupiter, a DEX aggregator on Solana, to quickly swap stolen assets like JLP, SOL, and wBTC into stablecoins like USDC.

2. Next, the hacker used cross-chain bridges to transfer these stablecoins from the Solana network over to the Ethereum mainnet.

3. On the Ethereum network, the hacker heavily bought ETH. As of 17:45 UTC, the address held 19,913 ETH (worth roughly $42 million).

Crisis Response and Immediate Actions

The official Drift Protocol team posted an urgent announcement on X, confirming the exploit and pausing all deposit and withdrawal functions. The team stated they are coordinating with multiple security firms, bridge providers, and exchanges to track the funds and contain the damage. Given the timing in April, the team specifically stressed, "This is not an April Fools joke," and advised users not to deposit any funds during the ongoing investigation.

Security Guidelines for Users Security experts recommend that users who have interacted with Drift Protocol take immediate protective measures. It is highly advised to use on-chain permission management tools to revoke approvals for all Drift smart contracts and avoid any interactions until the team officially confirms the vulnerability is fully patched.

Market Impact: The Fall of DRIFT Token

This severe security incident dealt a massive blow to the native token of the Drift platform. As news of the hack spread, the DRIFT coin price faced intense selling pressure in the market. In the past 24 hours, the DRIFT crypto price crashed by over 25%, breaking below the $0.064 support level.

As the governance and utility core of the Drift ecosystem, the DRIFT coin plays vital roles in the platform, such as offering trading fee discounts, providing staking rewards, and allowing for protocol voting. However, the sudden loss of $285 million in TVL has severely damaged investor confidence in the intrinsic value of the DRIFT crypto. A large number of traders and liquidity providers chose to close their positions and exit, leading to a further tightening of market liquidity and adding downward pressure to the token.

Looking at the future market performance of this asset, whether the DRIFT coin price can stabilize largely depends on the protocol team's ability to successfully recover the stolen funds, fully patch the underlying vulnerability, and rebuild trust with both institutional and retail investors. The current situation is undoubtedly the toughest market test the DRIFT crypto has faced since its launch.