Drift Protocol has suffered one of the largest decentralized finance (DeFi) exploits of 2026, with losses estimated at over $280 million, according to blockchain security firm PeckShield and the protocol’s official disclosures.
The incident reportedly wiped out more than 50% of the platform’s total value locked (TVL), triggering a sharp market reaction. The platform’s native token, DRIFT, plunged by approximately 37% following news of the breach, reflecting investor concerns over governance and security vulnerabilities.
According to preliminary findings, the attacker gained unauthorized administrative control through a sophisticated operation involving durable nonce mechanisms on Solana.
The exploit appears to have involved weeks of preparation, allowing the attacker to pre-sign transactions and delay their execution strategically.
Drift stated that the breach was not caused by a flaw in its smart contracts or program code, nor was there evidence of compromised seed phrases.
Instead, the attacker allegedly secured sufficient approvals within a 2-of-5 multisignature governance system, enabling a rapid takeover of protocol-level permissions.
Once control was established, the attacker introduced a malicious asset, removed withdrawal safeguards, and drained funds across multiple pools, including borrow/lend positions, vault deposits, and trading balances. Approximately $270 million worth of assets were siphoned, including significant amounts of USDC, ETH, and other tokens.
The attacker has already begun bridging funds from Solana to Ethereum using cross-chain infrastructure, moving an estimated 129,000 ETH valued at over $270 million.
In response, Drift Protocol has frozen all remaining operations and updated its multisig configuration to remove the compromised wallet.
The team confirmed that certain assets, including unstaked DSOL and insurance fund reserves, remain unaffected and are being secured.
The exploit highlights emerging risks tied to governance-layer attacks and advanced transaction mechanisms such as durable nonces.
It also underscores the growing complexity of threats facing DeFi protocols, where social engineering and operational weaknesses can be as critical as code vulnerabilities.
Investigations are ongoing, with further updates expected as the situation develops.
