GoPlus Security 🚦 (@GoPlusSecurity): 🚨 Drift Protocol Exploit Analysis

🚨 Drift Protocol Exploit Analysis On April 1, 2026, one of the largest DEXs on Solana, @DriftProtocol, was exploited. The attacker combined durable nonce + social engineering + multisig misconfiguration, taking admin control within minutes and draining ~$280M in just 10 seconds. 1.Attack Timeline ▪️ Mar 23, 2026 (Preparation – Initial Nonce Setup) The attacker created 4 durable nonce accounts. 2 were tied to Drift Security Council multisig members: 45cZ5Fj97Va5Abipr6NN8Zf1BqZqWneSek1hU5cQRvhw 39JyWrdbVdRqjzw9yyEjxNtTbTKcTPLdtdCgbz7C7Aq8 The other 2 were attacker-controlled: CZRBcHAvXU6TzzjGuG4rT98UuTR7PBUeSGPZRDW5mfYW 48cV6Mw5Y5afT8ofukvtFaMtrsCohHhsv8MfbdW8agh3 Signers were likely social engineered into pre-signing nonce-bound transactions, enabling delayed execution. This was the core setup of the attack. ▪️ Mar 27, 2026 (Multisig Migration) Drift migrated its Security Council multisig: 2/5 threshold + 0s timelock Only 1 old signer retained, others new This created a critical risk window. ▪️ Mar 30, 2026 (Second Nonce Setup) The attacker created new nonce accounts targeting updated multisig members (incl.6UJbu9ut5VAsFYQFgPEa5xPfoyF5bB5oi4EknFPvu924). At this point, the attacker effectively had ≥2 signer pre-approvals. ▪️ Apr 1, 2026 16:04:16 UTC (Trigger) A legitimate test withdrawal (10,000 USDC) was executed by Drift. Likely routine ops, but also confirmed attack timing. https://solscan.io/tx/BkUZ8nss1api3b4sFUDZAU81k2R2Y6SB4J77GF14UPrCeYGfRFaay1StPpwGTL86d1kJArWhiNi8xdAfR1AeVb6 ▪️ ~16:05 UTC (Admin Takeover) The attacker executed 2 pre-signed nonce transactions (within 4 slots): 1. Create & approve malicious proposal (change admin) 2. Approve & execute admin transfer Using only 2/5 signatures: 6UJbu9ut5VAsFYQFgPEa5xPfoyF5bB5oi4EknFPvu924 39JyWrdbVdRqjzw9yyEjxNtTbTKcTPLdtdCgbz7C7Aq8 Admin control was instantly transferred to attacker-controlled address. ▪️ Within ~10s (Drain) The attacker: -Created fake spot markets (CVT + manipulated oracle) -Disabled circuit breaker -Removed withdrawal limits Then drained real assets (USDC, WBTC, USDT). Main drainer: HkGz4KmoZ7Zmk7HN6ndJ31UJ1qZ2qgwQxgVqQwovpZES Total loss: ~$280M ▪️ Post 16:05 UTC (Laundering) Funds moved via: Jupiter / deBridge → Wormhole → Ethereum → mixers Main laundering wallet: 8ubo4HbWJHKyFJYJc2Gh74dxCP7bN7Fu2Pi13KZ9rGxw ▪️ Apr 1–2 (Response) Drift paused deposits/withdrawals, froze operations, updated multisig, and began working with security partners. 2. Root Cause This was NOT a contract bug, but a combination of poor ops + social engineering. ▪️ Weak multisig design 2/5 + 0 timelock Mostly new signers → low trust baseline ▪️ Durable nonce abuse Pre-signed txs disguised as normal ops → actually admin takeover ▪️ Operational exposure Multisig migration created attack surface No confirmed key leak, but behavior strongly suggests signer compromise or insider risk. 3. Security Recommendations For users: -Revoke all Drift approvals -Monitor official updates For protocols: ▪️ Multisig hardening≥3/5 or 4/7 + 24–48h timelock ▪️ Disable nonce for admin paths ▪️ Least privilege Circuit breaker / oracle / limits → immutable or DAO-controlled ▪️ Transparent signer validation ▪️ Full postmortem + compensation plan 4.Key Addresses & Transactions Drainer: HkGz4KmoZ7Zmk7HN6ndJ31UJ1qZ2qgwQxgVqQwovpZES Launderer: 8ubo4HbWJHKyFJYJc2Gh74dxCP7bN7Fu2Pi13KZ9rGxw 7igSaKEZKdfGy9nVB376FPcz4kVmR6MwMqdCCSb1Fgne Compromised signers: 6UJbu9ut5VAsFYQFgPEa5xPfoyF5bB5oi4EknFPvu924 39JyWrdbVdRqjzw9yyEjxNtTbTKcTPLdtdCgbz7C7Aq8 ETH receivers: 0x0FE3b6908318B1F630daa5B31B49a15fC5F6B674 0xD3FEEd5DA83D8e8c449d6CB96ff1eb06ED1cF6C7 0xAa843eD65C1f061F111B5289169731351c5e57C1 0xbDdAE987FEe930910fCC5aa403D5688fB440561B Admin transfer: https://solscan.io/tx/4BKBmAJn6TdsENij7CsVbyMVLJU1tX27nfrMM1zgKv1bs2KJy6Am2NqdA3nJm4g9C6eC64UAf5sNs974ygB9RsN1 Wormhole bridge: https://wormholescan.io/#/tx/4BbhEfr9tSURx99ypfspQiocA34otiwCvyYPdYssM8ntufqav9LGAFGQ1HsvqTvF6pftBfXoi1rKgdhnC8woiy9P Fund flow: Drift Vault → Drainer → Launderer → Jupiter/deBridge → Wormhole → ETH / Tornado Cash Drift is working with security firms, exchanges, and law enforcement to trace and freeze funds.