Drift Protocol: No evidence indicates that the mnemonic was stolen; the attack was highly sophisticated and took weeks to prepare.

BlockBeats message, April 2, Drift Protocol posted that a malicious actor gained unauthorized access by carrying out a new type of attack involving durable nonces, quickly taking over management permissions of the Drift Security Committee. This attack is highly complex and took several weeks to prepare, including using durable nonce accounts to pre-sign transactions for delayed execution.

Current investigation indicates that the cause of this incident is not a vulnerability in the Drift protocol or smart contracts; there is no evidence that the mnemonic phrase was stolen; the attacker obtained access through unauthorized or forged transaction approvals (possibly involving social engineering). The final outcome resulted in approximately $280 million in funds being withdrawn from the protocol. All lending, vault deposits, and transaction funds are affected. DSOL (not deposited in Drift, including assets staked to Drift validators) and insurance fund assets are not affected; the latter is being extracted for protection. As a preventive measure, all remaining protocol functions have been frozen, and the multisig has been updated to remove the compromised wallets.