Drift Protocol hack — April 2026

Drift Protocol, a derivatives exchange on Solana, lost about $295.4m on 1 April 2026 in under twelve minutes.

The attacker did not need a contract bug. Admin control was obtained by social-engineering the protocol's multisig signers. With a compromised admin key, a fake token was listed and its oracle price manipulated, which allowed the vaults to be drained against worthless collateral.

Early estimates ranged from about $285m to $295m, depending on the source and the point at which positions were valued. The Drift Foundation's recovery update of 30 September puts the amount taken from Drift users at about $295.4m, the figure recorded here, with $285m kept as the lower end. The DFX recovery token it launched on 1 October was issued at one token per USDT of verified loss with a fixed supply of 299,500,810.998, and the Foundation has not explained the difference between the two numbers. It is the third-largest incident of 2026 in this registry, after Bitget and the Liquid Network.

The Foundation brought in Mandiant, zeroShadow and SEAL 911 to investigate and trace the funds, and Mandiant identified the attacker as UNC6862, a North Korean threat group; analysis firms had earlier linked the attack to the Lazarus Group. No government has confirmed the attribution, so it is recorded here as alleged.

The stolen funds were bridged to Ethereum as about 130,259 ETH across four wallets. Three of them had not moved by 30 September and held 107,165 ETH; the fourth sent about 23,094 ETH into Tornado Cash on 23 July, and about $9.2m was frozen after the attacker moved funds through Tornado Cash in August. This registry counts funds frozen by an exchange or a stablecoin issuer as recovered, as its methodology states, so the $9.2m is recorded as recovered, although none of it has yet reached users. On 1 October the Foundation opened claims for DFX, which is redeemed from a recovery pool funded by part of the revenue of Velocity, the exchange rebuilt from Drift, by up to 127.5m USDT that Tether has committed to the relaunch and user recovery, by up to 20m USDT from other partners and by any recovered funds. The pool held about 3.11m USDT at launch, so each token redeemed for about 0.0104 USDT, roughly one cent per dollar lost. The outcome is recorded as partially recovered.