On April 1, 2026, Drift Protocol confirmed attackers drained approximately $285 million in user assets, marking the largest DeFi hack of 2026 and the second-largest exploit in Solana's history behind only the $326 million Wormhole bridge hack in 2022.
TRM's investigation suggests North Korean hackers orchestrated the attack. Drift, the largest decentralized perpetual futures exchange on Solana with billions in user assets, became a high-value target due to its complexity and scale.
The sophisticated attack involved weeks of preparation starting March 11, combining social engineering to pre-sign hidden authorizations, eliminating timelock protections, and exploiting oracle vulnerabilities. Attackers created a fictitious CarbonVote Token with minimal seeded liquidity that Drift's oracles accepted as collateral worth hundreds of millions.
