Root Cause
The Drift Protocol exploit was not a smart-contract code flaw — it was a governance and multisig social engineering attack attributed to the North Korean threat group UNC4736 (also designated UNC6862 by Mandiant).
Drift's Security Council used a Squads V4 multisig with a 2-of-5 signing threshold and no timelock on the admin key migration. Attackers spent weeks building trust with at least two Drift contributors, then compromised their devices via known malware vectors and obtained pre-signed durable nonces — Solana's mechanism for offline transaction signing. Once both signatures were in hand, the attacker replayed the pre-signed transactions against the live protocol in under 12 minutes.
A second enabling factor was fabricated collateral: the attacker minted approximately 750 million units of a worthless token called CarbonVote Token (CVT), used wash trading to inflate its on-chain price, and submitted it as a listed market so oracle price feeds treated it as valid.
# Simplified attack sequence (Solana)
1. Attacker social-engineers 2-of-5 multisig signers
2. Obtains pre-signed txs using Solana durable nonces (offline sigs)
3. Mints CVT token → wash-trades to inflate oracle price
4. Uses admin key to list CVT as a valid collateral market
5. Borrows protocol TVL against CVT collateral
6. Replays both nonce-bound admin txs → drains vaults in ~12 minutes
Attack Steps
| Step | Action | Detail |
|---|---|---|
| 1 | Recon & trust-building | Weeks of social engineering targeting multisig signers |
| 2 | Malware compromise | At least 2 contributor devices infected |
| 3 | Nonce pre-signature | Durable nonces allow offline signing of future transactions |
| 4 | Fake market listing | 750M CVT minted and wash-traded to manipulate price feeds |
| 5 | Vault drain | Admin upgrade drains vaults across Drift's AMM and lending markets |
| 6 | Fund exfil | Converted assets and bridged across chains |
| 7 | Oct 20 laundering | 25,700 ETH (~$61.5M) deposited to Tornado Cash in 100-ETH chunks |
Impact
- Total stolen: approximately $280M–$286M (estimates vary by source)
- Chain: Solana (primary); funds subsequently bridged to Ethereum
- Protocol: Drift Protocol (decentralised perpetuals and spot DEX)
- DPRK attribution: TRM Labs, Elliptic, and Mandiant all attribute the attack to North Korean state-sponsored actors
- Recovery: DFX recovery tokens launched Oct 1; approximately $9.2M frozen; only ~1% of affected users' losses covered under the current compensation plan
- October 20–21 laundering event: Attacker wallets deposited 25,700 ETH (≈ $61.56M) into Tornado Cash over ~2 hours in fixed 100-ETH and 10-ETH batches. Approximately 81,454 ETH (≈ $194M) remains under attacker control as of Oct 21, 2026.
Lessons for Auditors
- Multisig threshold and timelock are not independent controls — a 2-of-5 threshold with no migration timelock collapses to a 2-of-5 key-compromise problem. Audits should flag absent timelocks on any privileged action even when the multisig configuration looks safe on paper.
- Durable nonce abuse is a Solana-specific governance risk: pre-signed transactions using durable nonces can be replayed at any time; governance reviews should document which signers hold pre-signed operations.
- Oracle validation must include supply-cap and market-age checks: a freshly minted, low-liquidity token wash-traded to a high price should be automatically blocked from collateral listings.
- Social engineering is an attack surface: device security, 2FA enforcement, and signer rotation schedules are within the scope of a security review for high-value multisig protocols.
- Tornado Cash laundering pattern: fixed-chunk ETH deposits (100 ETH) are characteristic of DPRK-linked laundering; on-chain monitoring should alert on outflows from known exploit wallets.