The Drift exploit, replayed

Case study · April 1, 2026

The Drift exploit, replayed

About $285M was drained from the users of Drift Protocol, Solana's largest perpetuals exchange (Drift later put the loss at $295M). There was no contract bug and no private key was stolen. After a six-month social-engineering operation that, according to Drift, likely compromised two contributors' devices, two of the five Security Council members pre-signed transactions they did not fully understand. The transactions used durable nonces, so they never expired, and the multisig's time lock had been removed days earlier. The proposal that handed over Drift's admin appeared on chain and executed 1 second apart. Below are those exact transactions.

Timeline

Fall 2025 – March 2026 (per Drift)
Attackers posing as a trading firm build trust with Drift contributors in person. Drift says two contributors' devices were likely compromised: one through a shared code repository, one through a beta "wallet" app.
2026-03-24 01:22:06 UTC · slot 408,444,056 · on chain
An address that is not a council member, FMJnBk…Ni7YPF, creates durable nonce account 7s7s6s…9ktAeC and names member 39JyWr…7C7Aq8 as its authority. That needs no signature from the member. The account is not used again until the attack, so the member's signature on the attack transaction was made after this moment.
View on explorer
March 26, 2026 (per Chainalysis)
The Security Council migrates to a 2-of-5 multisig with zero time lock.
2026-03-31 02:35:49 UTC · slot 409,999,217 · on chain
The same address creates a second nonce account, EmYEry…vvhQnc, for member 6UJbu9…Pvu924. It too stays unused until the attack.
View on explorer
Late March (per incident reports)
The two members sign transactions that use these nonces — blind signing. The signatures stay valid indefinitely and are not on chain until used.
2026-04-01 16:05:18 UTC · slot 410,344,005
Member 39JyWr…7C7Aq8's pre-signed transaction lands: advance nonce → create proposal #7 → approve it.
View on explorer
2026-04-01 16:05:19 UTC · slot 410,344,009
Member 6UJbu9…Pvu924's pre-signed transaction lands: advance nonce → approve → execute. The vault calls Drift's updateAdmin: the new admin is H7PiGq…uy7ZgL, an address outside the multisig.
View on explorer
Right after (per incident reports)
With admin control, the attacker lists a worthless token as collateral and withdraws users' real assets — the largest withdrawals within minutes. The multisig did not hold those funds; it held the admin role that let the attacker take them.

What was missing

A screen that says what a signature does, and a hand that can still say "stop". The signers' devices were compromised, so a warning on that same screen could have been faked too. That is why Presign sends the same brief to every signer's phone through Watchtower, shows the message hash to compare on a hardware wallet, and why Presign Guard makes critical actions wait for a veto by any one guardian. We cannot say Presign would have stopped this attack; we can show what these bytes do.

The trail was also public before the attack: the nonce accounts naming two council members as their authority were on chain 8 days and 1 day earlier, created by an address outside the council. Presign now flags any vote that lands through a durable nonce (inspect proposal #7). Watching for new nonce accounts that name a member is on our roadmap: it needs a full transaction stream, because about 240 transactions per second touch durable nonces on mainnet.

Run Presign on what they signed

Each button sends the exact message bytes that member signed (signatures removed) to the same analysis any signer would use. The multisig 2LW6PS…byhx88 and Drift's IDL are read live from mainnet. The simulation fails today because those accounts have since changed — the verdict comes from the bytes themselves.

Sources

Transaction data is public mainnet data. Off-chain details (how signatures were obtained, the drain) are summarized from the reports above.