Breaches and incidentsBriefChecked against a primary source
Drift Protocol: social-engineered Security Council signers pre-signed durable-nonce takeover
First withdrawal 16:06:09 UTC 1 Apr 2026: about USD 280M (Drift) to USD 285M (PeckShield) drained in about 12 minutes across 31 transactions.
- Disclosed
What happened
- Root cause per Drift’s disclosures as summarized by Range and BleepingComputer: a months-long social engineering campaign against contributors (Range cites a cloned repository with a malicious VS Code tasks.json and a beta wallet app installed via TestFlight). Two of five Security Council signers pre-signed Solana durable-nonce transactions. A 27 Mar migration to a 2-of-5 council with zero timelock let them take admin control, list a fake token (CarbonVote, CVT) as collateral with wash-traded oracle history, raise withdrawal limits and drain. Drift says no program or contract flaw was exploited.
- Attribution: Elliptic and TRM linked it to DPRK actors (BleepingComputer). Range states medium-to-high confidence in UNC4736 / Lazarus affiliates.
- Response: deposits and withdrawals paused. Drift published technical and social-engineering disclosures and later relaunched.
Sources
- https://range.org/blog/inside-the-drift-exploit-how-to-protect-your-protocol-and-multisigs-against-dprk-threat-actors
- https://bleepingcomputer.com/news/security/drift-loses-280-million-as-hackers-seize-security-council-powers
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.