$285M Gone in 20 Minutes — Drift Hack Feels Less Like a Bug, More Like a Setup

So… this one hit hard.

Drift Protocol — a Solana-based DEX — just got drained for $285 million. Not a glitch. Not some obvious bug. Something way more calculated.

And honestly? It’s starting to look like the kind of attack that doesn’t break code — it breaks people.

It happened fast. Really fast.

The whole thing lasted under 20 minutes.

At first, it was just weird on-chain activity. Then confirmations started rolling in — funds moving, vaults getting emptied, alerts lighting up.

By the time Drift paused deposits and withdrawals… it was already done.

Nearly $300 million gone, pulled from around 20 different vaults. USDC, USDT, WBTC, ETH — basically everything with value.

And just like that, half the protocol’s total value locked disappeared.

From about $550M… down to roughly $250M.

That’s not a dip. That’s a collapse.

The aftermath? Messy.

The DRIFT token dropped hard — around 40% in a day.

Meanwhile, the attacker didn’t waste time.

They swapped over $270 million into USDC, bridged it to Ethereum, and then bought around 129,000 ETH. Split across multiple wallets, of course.

Clean exit. No hesitation.

Which tells you something — this wasn’t improvised.

So what actually went wrong?

Here’s the twist.

It wasn’t a smart contract bug.

Drift itself confirmed it — no broken code, no exploit in the usual sense. The contracts held up.

Instead, the attacker got control through something more subtle: admin-level access.

Using a mechanism called durable nonces, they were able to pre-sign transactions and execute them later. Quietly. Delayed. Hard to detect.

But even that alone isn’t enough.

To pull this off, they likely needed approvals. Real ones.

From real people.

Which brings us to the uncomfortable part

This might’ve been social engineering.

Meaning — instead of hacking the system, they manipulated the operators.

Got them to approve something they shouldn’t have. Maybe weeks in advance. Maybe disguised as routine actions.

And once those approvals were in place?

Execution was just a matter of timing.

This isn’t new… and that’s the problem

If this sounds familiar, it should.

The method looks a lot like last year’s Bybit hack — the one linked to North Korean groups.

Long-term access. Slow infiltration. Then a precise, coordinated strike.

Not loud. Not sloppy.

Just… patient.

And yeah, that’s becoming a pattern.

Even Solana’s leadership is saying it out loud

Lily Liu from the Solana Foundation didn’t sugarcoat it.

Smart contracts worked fine, she said.

The weak point?

Humans.

Operational security. Signing processes. Internal controls.

That’s where attackers are focusing now.

Because it’s easier.

So where does that leave DeFi?

A bit exposed, honestly.

For years, the conversation was all about audits, code quality, formal verification. And those things still matter.

But this? This is different.

It’s about who clicks approve.
Who verifies what they’re signing.
Who gets access to what system — and for how long.

Less about code. More about behavior.

Final thought — this one’s a warning

Not just for Drift. For everyone.

Because if a protocol can do everything “right” on the technical side… and still lose $285 million in minutes?

Then the game has changed.

It’s not just about building secure systems anymore.

It’s about running them securely too.

And clearly… that part’s getting tested.

Drift Protocol's $285M Exploit: Human Error or Bug?

Related Articles

John Crypto

Cryptocurrency — finally simple