Major Solana hack: Drift suspends operations
Here’s how the attack unfolded and where the funds were moved.
02.04.2026 - 14:15
238
2 min
0
Key points:
- Drift was hit by an active exploit, with estimated losses between $200M and $270M.
- Deposits and withdrawals have been halted, and the likely cause is a compromised admin key.
Drift, a Solana-based trading platform, confirmed an ongoing attack on its protocol. As a result, both deposits and withdrawals were temporarily suspended. The team said it is working with multiple security firms, bridges, and exchanges to contain the damage.
The attack began more than two hours before Drift made its official announcement. Early estimates put losses at no less than $200 million, with some on-chain data suggesting the total could be closer to $270 million.
Drift issued a warning on X, urging users not to deposit funds until the investigation is complete. It was later confirmed that withdrawals had also been disabled. Helius CEO Mert Mumtaz noted that signs of the exploit appeared before Drift publicly acknowledged the breach.
Attack Details and Fund Movements
Security researcher Vladimir S suggested the most likely cause was a compromised admin key. According to him, the key was either stolen or misused by its holder to execute malicious changes.
Using this access, the attacker drained funds from several Drift vaults, including JLP Delta Neutral, Solana Super Staking, and Bitcoin Super Staking. One transaction alone involved 41.7 million JLP tokens, worth approximately $155 million.
Other stolen assets included Solana, USDC, cbBTC, and wBTC.
Data from Arkham shows that over $250 million was first moved to an intermediary wallet and then distributed across multiple addresses. Analysts at Lookonchain reported that the attacker began converting the funds into USDC via Jupiter, a Solana-based DEX aggregator.
The funds were then bridged to the Ethereum network and used to purchase ETH. By 5:45 PM UTC on Wednesday, the attacker’s wallet held around 19,913 ETH, valued at roughly $42 million.
Following news of the attack, the DRIFT token dropped more than 20%, trading at around $0.05. Earlier that same day, it had reached $0.68. Solana also declined, falling to $83.82 before partially recovering.
Useful material?
Incidents
Developers warned of potential risks to bridges across the ecosystem and asked exchanges for assistance.
Jun 22, 2026
Incidents
The defendant helped move funds stolen through investment scams and earned at least $4 million for his role in the operation.
Jun 10, 2026
Incidents
The company is linking the incident to a compromised private key on a service wallet, rather than a smart contract exploit
May 22, 2026
Incidents
Following the incident, the project temporarily halted trading operations and node activity.
May 15, 2026
Incidents
The user spent weeks unsuccessfully trying to guess the password until Claude helped find an old wallet backup file
May 14, 2026
Crypto regulations
Authorities are introducing mandatory registration for companies handling cross-border crypto transactions
May 8, 2026

Telegram
Twitter