YieldMap retweeted
Kamino's scorecard on security.
The most thorough security setup I've seen on Solana.
Full breakdown👇
Jupiter Lend is LIVE on Project 0 🎉
P0's Prime engine now covers ~98% of Solana lending TVL — with 8 isolated markets across Kamino, Drift, JupLend & P0-native.
One account health
One liquidation threshold
One margin account
One borrow rate
One UI
Better capital efficiency ↓
YieldMap retweeted
We hit a major milestone this week!
Whether you signed up for the beta, or you just joined yesterday - we want to thank all 10,000 of you for your support.
But the job's not done yet.
YieldMap retweeted
The Drift incident hits hard, it stings for the whole ecosystem.
Drift has been working around the clock to investigate and contain it. We're supporting where possible.
Smart contracts held up. The real targets now are humans: social engineering and opsec weaknesses more than code exploits.
Solana has come through tough spots before by shipping faster, building better, looking out for each other - and shipping safer.
Stay safe, watch your own setups, and keep building.
More updates as they come.
Earlier today, a malicious actor gained unauthorized access to Drift Protocol through a novel attack involving durable nonces, resulting in a rapid takeover of Drift’s Security Council administrative powers.
This was a highly sophisticated operation that appears to have involved multi-week preparation and staged execution, including the use of durable nonce accounts to pre-sign transactions that delayed execution.
YieldMap retweeted
Below is the timeline of events.
March 23: Initial Nonce Setup
Four durable nonce accounts were created:
- Two associated with Drift Security Council multisig members
- Two associated with attacker-controlled accounts
Relevant accounts:
a. 45cZ5Fj97Va5Abipr6NN8Zf1BqZqWneSek1hU5cQRvhw — multisig member
b. 39JyWrdbVdRqjzw9yyEjxNtTbTKcTPLdtdCgbz7C7Aq8 — multisig member
c. CZRBcHAvXU6TzzjGuG4rT98UuTR7PBUeSGPZRDW5mfYW — attacker-controlled
d. 48cV6Mw5Y5afT8ofukvtFaMtrsCohHhsv8MfbdW8agh3 — attacker-controlled
Implication:
At least 2/5 multisig signers had signed transactions tied to durable nonce accounts, enabling delayed execution.
March 27: Multisig Migration
- Drift executed a planned Security Council migration due to a council member change.
March 30: Additional Nonce Activity
- A new durable nonce account was created for a member of the updated multisig: 6UJbu9ut5VAsFYQFgPEa5xPfoyF5bB5oi4EknFPvu924
Implication:
The attacker again obtained effective access to 2/5 signers in the updated multisig.
YieldMap retweeted
NEW: SOLANA FOUNDATION CHIEF PRODUCT OFFICER @vibhu SAYS @DriftProtocol EXPLOIT "IS AN ISOLATED INCIDENT AND SAYS NOTHING ABOUT SOLANA DEFI OR ANY OTHER SOLANA PRODUCT" - "I KNOW THE SOLANA DEFI COMMUNITY WILL PICK UP THE PIECES AND REBUILD FAST AS ONLY SOLANA CAN"
YieldMap retweeted
Earlier today, a malicious actor gained unauthorized access to Drift Protocol through a novel attack involving durable nonces, resulting in a rapid takeover of Drift’s Security Council administrative powers.
This was a highly sophisticated operation that appears to have involved multi-week preparation and staged execution, including the use of durable nonce accounts to pre-sign transactions that delayed execution.
YieldMap retweeted
Everything about @DriftProtocol Exploit
And 8 other protocols that got effected (TL;DR) 🧵👇
$270M drained
That’s 50% of their entire TVL gone
The attacker didn’t panic
Looking like they had pre-funded wallets ready a week before
Hacker wallet:
HkGz4KmoZ7Zmk7HN6ndJ31UJ1qZ2qgwQxgVqQwovpZES
This wallet was funded 8 days ago via near intents, but was inactive and suddenly received huge amounts from drift vault
Then today they pulled the trigger
In under an hour:
$155M in JLP
$60M in USDC
$11M in CBBTC
$4.7M in WETH
dozens of other assets
They swapped everything, bridged off Solana, and bought $82M+ in ETH
Deposited SOL directly into Binance and HyperLiquid
Token $DRIFT down over 35%
And it’s not over
Funds are still moving. Right now, and hacker is using @phantom, which made them already $10k in fees, lol
The exploiter currently holds $269.7M spread across wallets:
$141M in SOL
$82M in ETH
$18M in BTC
Hacker was still swapping millions of SOL to USDC and bridging out almost 3 hours after the hack
Didn’t seem like a rushed attack
It was planned, coordinated, and executed on April Fool’s Day on purpose
One of the team members left from protocol one month before it has happen
People think maybe there is connection
But, a lot of other protocols got effected by Drift hack...
Here is full list:
@reflectmoney - USDC+ is farming yield on Drift; mint and redemption of USDC+ has been frozen; funds are insured
@DeFiCarrot - CRT yield bearing token, team confirmed that Carrot has been impacted by the recent exploit on the Drift protocol
@project0 - protocol paused; no new borrows can be made agains drift positions
@piggybank_fi - $106.4k/$4M of funds were deployed to Drift (~2.6%)
@ranger_finance - rUSD has exposure to Drift, but no statement from the team so far
- uses Drift for yield and credt; user funds withput open loans are moved away for security reasons
@TradeNeutral - Classic deposits may be affected according to the team
@xplaceapp- uses Drift (besides Kamino) for yield on Savings, no statement from the team so far
@elementaldefi - uses Drift for USDC Vaults, no statement from the team so far
There no information how exactly hack happend
Stay safe, protect your funds, and be strong to everyone who lost money 🙏
(Some of the information I got from @_0xaryan and @derparsel thx to them!)
In total, $270.6M worth of assets was exploited on Drift, which is around 50% of its TVL.
Assets stolen in dollars:
$5.3M USDS
$60.4M USDC
$5.65M USDT
$430K JUP
$540K USDY
$590K ZBTC
$680K EURC
$1M BSOL
$2.5M INF
$2M MSOL
$3.3M SYRUPUSDC
$4.1M FARTCOIN
$4.4M WBTC
$3.6M JITOSOL
$4.7M WETH
$4.5M DSOL
$11.3M CBBTC
$155.6M JPL
HkGz4KmoZ7Zmk7HN6ndJ31UJ1qZ2qgwQxgVqQwovpZES
YieldMap retweeted
Drift Protocol is experiencing an active attack. Deposits and withdrawals have been suspended. We are coordinating with multiple security firms, bridges, and exchanges to contain the incident. This is not an April Fools joke. We’ll provide additional updates from this account as more information is available to share.






















