Solana-based DeFi protocol Drift Protocol lost $286 million on April 1, 2026, in what has become the largest DeFi hack of the year. The attack used a sophisticated 'durable nonce' exploit rather than a code vulnerability, allowing attackers to pre-sign administrative transfers weeks before execution. Security firms Elliptic and TRM Labs have attributed the attack to North Korean-linked threat actors, citing patterns consistent with previous DPRK operations including Tornado Cash origins and social engineering tactics.
The contagion spread to over 20 protocols including Prime Numbers Fi, Carrot Protocol, and Pyra Protocol, with users remaining unable to access funds as of April 3, 2026. Drift suspended all deposits and withdrawals following the attack, coordinating with multiple security firms and exchanges to contain the incident.
