Details of the attack targeting @DriftProtocol…
The attacker mined a CarbonVote token called $cvt about 2-3 weeks ago, and created a pool on Raydium with 500u (one $cvt is 1u).
Then they started manipulating the volume, creating a “price history” for the oracle (this step is crucial).
The attack was launched on April 1st.
The attacker obtained the admin key - first, they listed the CVT token on Drift's spot (this step allows CVT to be used as collateral), and simultaneously removed the USDC withdrawal limit on various vaults.
Then, through 5 wallets, they pledged 785m (worth 785mu) of CVT as collateral (CVT has a spot on DriftProtocol with price feeds) into the protocol, and then aggressively borrowed and borrowed on various spot markets. Using 31 transactions within 12 minutes, they borrowed USDC JLP… The funds from over 20 vaults, including USDT, were plundered, resulting in losses exceeding 200 million.
Then, the assets were transferred to Ethereum via Wormhole and then exchanged for $eth (Who says
$eth has no value?).
This attack was essentially a compromise of the admin key.
Intriguingly, it's rumored online that Drift's core members left a few weeks ago... At this point in time, having an admin key and using collateralized lending logic, the entire attack took about 20 minutes...
Hopefully, the assets can be recovered.
Source: x.com/ArxsTV/status/2039423108...…