Solana-based Drift Protocol suffered a massive $285 million exploit on April 1, 2026, marking the largest crypto hack of the year. The attack exploited multiple weaknesses including a fake token called 'CarbonVote Token' (CVT), manipulated oracle pricing, and a compromised admin key. The attacker created CVT weeks before the exploit, seeded a small $500 liquidity pool on Raydium, and used wash trading to build artificial price history near $1. On April 1, they used compromised admin keys to list CVT as valid market on Drift while raising withdrawal limits to extreme levels. The sophisticated operation wiped out more than half of Drift's total value locked (TVL), with funds quickly bridged to Ethereum using Circle's CCTP protocol. Several other platforms paused operations while conducting security checks, though Jupiter Exchange confirmed its JLP pool remained fully backed.