# Drift Protocol hack: Drift Protocol on Solana loses roughly $285M-$296M in April 2026 admin-control compromise (reported)
Source page: https://vaultx.llc/hacks/drift-protocol-hack-november-2026 · VaultX incident report by Sentinel · first published 2026-11-09, updated 2026-11-09
- Date: 2026-04-01
- Reported loss: $296M (Drift's own asset list totals $295,706,374.93 across 19 assets; other reports cite roughly $285M to $296M, not independently verified)
- Attribution: Drift attributed the exploit to a DPRK-affiliated threat actor, and reporting says Mandiant named UNC6862 in Drift's June update; the research does not independently verify this attribution
- Chains: Solana, Ethereum, Hyperliquid
- Status: developing
- Severity: 76/100
- Response score: 55/100 (Trading was paused and a recovery plan was published, but the recovery pool was reportedly small relative to losses, and the research shows limited timing detail for early disclosure.)
According to Drift and later reporting, the April 1, 2026 exploit was a social-engineering and administrative-control compromise rather than a smart-contract bug. Reporting says attackers spent months building trust with the team, then tricked Security Council members into blind-signing durable-nonce transactions that silently transferred protocol control. Reported losses cluster around $285M to $296M, and the exploiter reportedly began moving and trading proceeds through Ethereum, Tornado Cash and Hyperliquid in October and November 2026.

**What happened**
According to Drift and later reporting, the Drift Protocol exploit occurred on April 1, 2026 and was caused by social engineering and administrative-control compromise, not a smart-contract bug.
Reporting says attackers posed as a trading firm and spent months building trust inside the Drift ecosystem before gaining access to signers and admin controls.
According to reporting, the attackers tricked Security Council members into blind-signing durable-nonce transactions that silently transferred protocol control.
Drift's own asset list totals $295,706,374.93 across 19 assets, while other coverage uses rounded figures of about $285M, $295.4M or $296M.
Drift paused core functions and temporarily suspended trading and borrowing to prevent further unauthorized activity, according to the research.

**How it worked**
The reported method combined social engineering with pre-signed durable-nonce transactions. These let an attacker execute malicious admin actions later, bypassing normal approval expectations, according to the research.
One summary says the attack setup began with durable nonce accounts created on March 23, 2026, followed by blind signatures used to seize admin control on April 1, 2026. This is reported and not independently verified.

**Where the money went**
Reportedly, ETH was deposited into Tornado Cash in October and November 2026. Stolen assets were reportedly swapped to USDC via Jupiter or CoWSwap, bridged to Ethereum and Hyperliquid, and used for leveraged BTC and ETH positions. Circle reportedly froze three CCTP transfers totaling about 3.36M USDC. Reported held balances differ by source, including about 130,259 ETH across four wallets and about 81,454 to 81,864 ETH in a later snapshot.

**The response**
Drift temporarily suspended trading and borrowing, said it was rebuilding the protocol, and launched a recovery framework for affected users. It opened DFX recovery token claims on October 1, 2026, from a recovery pool reported at about $3.1M at launch. Reporting says Drift is working with law enforcement and forensic partners and that legal proceedings are ongoing. A Tether-backed rescue package of up to $127.5M, within a reported $147.5M support package, is mentioned, but the cited source appears to concern a different case and this is not confirmed.

**Impact**
Affected Drift users and liquidity providers faced large losses. One report said the recovery pool was about one cent per dollar lost when claims opened. The exploiter's continued fund movement and leveraged trading in late 2026 kept the incident active, according to reporting. The research does not include direct user quotes or quantified market-wide price impact.

**Timeline**
- 2026-03-23 Reportedly, attackers set up durable nonce accounts as the first step of the attack, per one summary.
- 2026-04-01 Drift exploit occurs; reportedly, admin control is seized through blind-signed durable-nonce transactions.
- 2026-10-01 Drift opens DFX recovery token claims and redemptions, per reporting.
- 2026-10-20 Reportedly, wallets linked to the exploiter begin depositing ETH into Tornado Cash; reported amounts vary between sources (about 44,510 ETH or 24,885 ETH in one wave).
- 2026-10-21 Reported second day of Tornado Cash deposits; one source totals about 50,595 ETH (about $122M) over two days.
- 2026-11-05 Reporting says the exploiter moved about 25,700 ETH (about $61M) into Tornado Cash after two months of inactivity, with about 81,454 to 81,864 ETH reportedly still held.
- 2026-11-09 On-chain reports say the attacker used leveraged Hyperliquid positions, including 20x BTC long and 20x ETH short trades worth about $13M each, after bridging swapped USDC.

**How to protect yourself**
- Treat multisig and Security Council signing as high-risk: verify every transaction's full contents on a separate device before signing, especially durable-nonce or pre-signed transactions.
- Be wary of long-running relationships with unknown trading firms that seek access, signers or admin privileges.
- Protocol teams should limit admin authority, use time-locks and independent review of privileged actions, and monitor for unusual nonce account creation.
- Users should size positions in protocols with concentrated admin control and track official recovery terms, since compensation pools may cover only a fraction of losses.

**Still unknown**
- Exact wallet addresses for the attacker are not present in the research and cannot be verified from these sources.
- The DPRK attribution and the UNC6862 naming are reported by sources that the research does not independently confirm.
- Reported loss figures range from about $285M to $296M and the asset count and composition are not reconciled across sources.
- Reported ETH holdings and transfers conflict between sources (for example 44,510 vs 24,885 vs 25,700 ETH moved, and 81,454 vs 81,864 vs 130,259 ETH held).
- The Tether rescue package of $127.5M is cited to a source whose URL refers to a different case, so its link to Drift is unconfirmed.
- Whether frozen funds will be recovered and the outcome of law enforcement or legal proceedings are not known.
- The exact details of how Security Council members were deceived and the identities of the individuals or firm involved are not established in the research.

**Sources**
- Drift Protocol recovery plan for affected users https://www.drift.trade/updates/recovery-plan-for-affected-users
- Drift exploiter resurfaces after 2 months, moves $61.6M in ETH to Tornado Cash https://ground.news/article/drift-exploiter-resurfaces-after-2-months-moves-616m-in-eth-to-tornado-cash
- Drift exploiter moves $61M ETH to Tornado Cash after two months https://gokhshtein.com/news/2026-11-05-drift-exploiter-moves-61m-eth-to-tornado-cash-after-two
- Drift latest updates (CoinMarketCap) https://coinmarketcap.com/cmc-ai/drift/latest-updates/
- Odaily newsflash on Drift http://www.odaily.news/en/newsflash/532071
- Blockchain Breaches: Drift Protocol 2026 https://www.blockchainbreaches.com/en/breaches/drift-protocol-2026
- Drift exploiter sends $61M ETH to Tornado Cash (Cointelegraph via TradingView) https://www.tradingview.com/news/cointelegraph:d3e45ed70094b:0-drift-exploiter-sends-61m-eth-to-tornado-cash-holds-194m/
- Drift exploiter Tornado Cash report (Blockchain Reporter) https://blockchainreporter.net/drift-exploiter-tornado-cash/?referrer=www.coinrithm.com/en/cryptocurrencies/drift
- Drift exploiter moves ETH to Tornado Cash, defi-planet https://defi-planet.com/2026/10/drift-hacker-moves-61m-in-eth-as-195m-remains-frozen/
- Salus/ChainCatcher report on Drift https://www.chaincatcher.com/en/article/2297833
- Drift incident page (DeFi Safety Tools) https://defisafetytools.com/incidents/2da333e21f3321294465/
- Biggest crypto hacks 2026 (Pintu) https://pintu.co.id/en/academy/post/biggest-crypto-hacks-2026
- Drift exploiter sends $61M ETH to Tornado Cash, retains $194M (Gokhshtein) https://gokhshtein.com/news/2026-10-23-drift-exploiter-sends-61m-eth-to-tornado-cash-retains-194m
- Mitrade live news 2026-11-09 https://www.mitrade.com/cn-au/insights/news/live-news/article-3-2240148-20261109
- Odaily newsflash 532073 https://www.odaily.news/zh-TW/newsflash/532073

---
VaultX: free crypto news and intelligence, https://vaultx.llc