Drift Protocol under active attack, losing over $250M on Solana

Solana-based decentralized exchange Drift Protocol is currently experiencing an active exploit that has resulted in the theft of more than $250 million in crypto assets, according to on-chain data.

The protocol, primarily used for trading perpetual futures, has paused deposits and withdrawals as it investigates the incident.

“Drift Protocol is experiencing an active attack,” the team posted on X on Wednesday. “Deposits and withdrawals have been suspended. We are coordinating with multiple security firms, bridges, and exchanges to contain the incident. This is not an April Fools joke.”

Timeline of the exploit

Suspicious activity was first noticed around 11:06 a.m. ET, when approximately 41 million JLP tokens (valued at $155 million) were transferred from the Drift vault to a Solana address starting with HkGz4K. Shortly thereafter, millions more in various crypto assets were moved to the attacker and redistributed to other wallets.

On-chain analysis indicates that the attacker’s address was first funded with 1 SOL last week and may have had access to the exploit since then, having previously received a small transfer of $2.52 from the Drift vault.

Following Wednesday’s transfers, blockchain analytics firm 5 reports total losses exceeding $250 million, while PeckShield Alerts estimates the exploited amount could be as high as $285 million.

Suspected cause: admin key compromise

While Drift Protocol has not publicly confirmed the exact cause, security experts and on-chain researchers suggest the exploit may be the result of an exposed admin key, allowing the attacker to access privileged functions and drain the vaults.

Jiang Xuxian, founder of blockchain security firm PeckShield, told Decrypt that the attack relied on gaining administrative access.

“The admin keys behind Drift were definitely leaked or compromised,” Jiang said.

If confirmed, this points to human error rather than a technical vulnerability, a recurring theme in major DeFi exploits.

Impact on the Solana ecosystem

Drift Protocol had approximately $550 million in total value locked (TVL), according to DefiLlama, and its ecosystem connections span multiple Solana-based projects. Some Solana treasury firms, including Forward Industries and DeFi Development Corp, reported that their funds were unaffected.

Infrastructure firms like Phantom have issued warnings to users who may attempt to access Drift during the ongoing investigation.

Meanwhile, DRIFT, the protocol’s native token, has dropped nearly 28% on the day, trading around $0.049, down more than 98% from its November 2024 all-time high of $2.60.

Managing DeFi Risks

This exploit underscores persistent security challenges in the Solana DeFi ecosystem, particularly around privileged access and key management. Even mature protocols with significant TVL remain vulnerable to human error, which can have systemic consequences due to interconnected DeFi networks.

For users and investors, the Drift incident highlights the importance of monitoring on-chain activity in real time, limiting exposure to single protocols, and being cautious with admin key or governance access points

For the broader market, this incident is a reminder that DeFi security remains a critical factor as Solana and other Layer 1 networks continue expanding their ecosystems.