avatar
MYU's Research
Follow
Posts
avatar
MYU's Research
✏️Drift Protocol $200M+ Hacking, Is It a Planned Crime? Original Thread To start with the conclusion, it is not a code exploit. It is not a flash loan. Nor is it a traditional key theft. It is a planned crime prepared over several weeks. Stage 1: Setup (2-3 weeks ago, original Chinese text) The attacker minted $CVT (CarbonVote Token). They created a pool on Raydium with 500U (1 CVT = 1U) and artificially manipulated trading volume to plant "price history" in the oracle. This was a strategic move to use it as collateral later. At this point, no one knew. Stage 2: Loading the Time Bomb (3/23) Solana's durable nonce feature was introduced. A transaction can be signed today and executed later, whether it takes days or weeks. It is like keeping a signed check in a drawer. The attacker used this to set up four delayed-execution accounts. Two were actual connections to Drift Security Council members, and two were the attacker himself. Two Security Council members were tricked into blind signing using social engineering. They were unaware of what they were signing. Drift called it "transaction misrepresentation," but honestly, it was like handing over the key to their own safe. These signatures remained dormant for 9 days. Stage 3: Replacing the Security Council Was Useless (3/27) Drift replaced the Security Council. New members, new setup. But it was no use. Two of the new five members were compromised again. Furthermore, they switched to 2/5 multisig and even removed the time lock. The community is now criticizing why they did this. (Comment by indra) Stage 4: Detonation (4/1) Drift dropped a routine test transaction. Exactly 60 seconds later, the attacker executed two pre-signed transactions. They detonated Solana in succession with a difference of 4 slots. Hijacking of full admin privileges. From here on, it was lightning fast. Listing CVT on the Drift spot → Lifting withdrawal limits on each vault → Depositing 785M CVT collateral into 5 wallets → 31 transactions, draining all 20+ vaults including USDC, JLP, USDT, etc. in just 12 minutes → Cross-chaining Ethereum via Wormhole → Swapping to ETH. (On-chain receipt) Total execution time: approximately 20 minutes. Why this is scary: Blind signing + durable nonce (a structure similar to EVM approval) + fake token oracle manipulation + admin key theft. This is an attack combining these four elements into one. The system operated exactly as designed. It wasn't a code bug. It was the human element that was compromised. And one more thing. There are rumors that key personnel at Drift left a few weeks ago. Who is the person who has the admin key at this timing, perfectly understands the collateral loan logic, and can execute it in 20 minutes? by Myu's China Expert
CVT
0%
avatar
MYU's Research
03-29
Adam's Weekly Markets I don't know how you feel, but it is always bizarre to see world leaders broadcasting war situations on social media. The market rebounded strongly on Monday after Trump posted that a ceasefire was underway, but gave back all its gains as Iran flatly denied the claim. The S&P 500 closed at 6,369 on Friday, marking its fifth consecutive week of decline and hitting a seven-month low. The Dow Jones Index also entered a correction phase, joining the Nasdaq and Russell 2000. The MAG7 saw its market capitalization evaporate by as much as $850 billion in just one week. Brent crude closed at $112.57 after a crazy roller coaster ride. It fell 11% on Monday due to ceasefire expectations, but struggled to climb back above $108 on Thursday. The Strait of Hormuz remains effectively closed, and while the risk premium is already somewhat priced in, there is still potential for oil prices to rise further. Macroeconomic conditions are rapidly deteriorating. The OECD raised its forecast for U.S. inflation to 4.2%, 150 basis points higher than the Fed's own estimate of 2.7%. CME FedWatch predicted a 52% probability of a rate hike by the end of the year for the first time in history. The 10-year Treasury yield hit 4.41%, marking its highest level since July 2025. This is compounded by oil-driven inflation that the Fed cannot resolve with rate cuts, a labor market too strong to justify accommodative policies, and growth forecasts that are being revised downward every week. Tech stocks took a hit from multiple angles. Micron plunged 15% in a single week, despite posting record-high quarterly earnings, following Google's announcement of its TurboQuant algorithm (which claims to reduce LLM memory requirements by six times). Meta fell 11% as a $375 million child safety ruling combined with a general risk-averse market. Oracle has plummeted more than 50% from its September high. Trump's five-day grace period for striking Iran's energy infrastructure ends today. Depending on whether the bomb drops first or diplomats step in first, Monday's opening could see a 3–5% gap in either direction. Next week will also be very exciting. Influential news from the U.S. and major central banks is waiting on almost every trading day. Friday is packed with the release of the Non-Farm Employment (NFP) data and a speech by Chairman Powell; if wages remain high while employment data comes out weak, talk of a recession will instantly shift from mere background noise to front-page headlines. + The original also covers the S&P 500 (downward trend) and Crypto (TAO issues, HYPE, BTC direction) as separate subtopics.
NFP
5.16%
avatar
MYU's Research
03-26
Planning a Backpack OTC Block: Even doing this is difficult. Situation 1. Almost all of the Sybil tokens held by Chinese investors have been reviewed and are currently being distributed. 2. An OTC block was opened during the distribution process. 3. The problem is that the exchange miner opened the OTC block at the "total loss" line. 4. For a typical perpdex, the correct conclusion would be to immediately conclude that the business has failed when the token price reaches the total loss zone. 5. Nevertheless, only additional buyers or holders remain who are pinning their hopes on the exchange's internal assets. 6. Backpack must somehow drive up the price. Nothing has been released since the TGE, and with toxic clauses found everywhere on the IPO staker page, the largest part of the token's utility is disappearing. It is impossible to know what the TGE prep was all about; it seemed like nothing was done during the TGE. 7. They need to list on an exchange. However, their own words are holding them back. "The team does not hold the tokens." —» In other words, regardless of whether the team actually holds the tokens or not, they cannot fulfill the requests of exchanges asking for tokens via OTC. 8. They executed the OTC order book believing it would resolve significant price volatility. However, the timing was completely off. There is absolutely no strategic advantage in opening it when everyone is at a loss. 9. On the contrary, it only clearly reveals that the current Backpack exchange has weak liquidity and is unable to absorb volume, further intensifying suspicions that they are purchasing tokens intended for Chinese investors at a low price. 10. They must somehow drive the price up. Instead of merely claiming to be different from Perpdex, they should have treated all users favorably, given that their vision was a CEX that included those using Perpdex. 11. Due to the short-sighted, arrogant judgment that they needed to filter out real users, beneficial relationships that were genuinely helpful to the exchange are being offboarded. 12. In this situation, the success of the IPO is not the issue; rather, a direct red light has been turned on for the process leading up to the IPO, the exchange's revenue, maintenance, and additional business activities. Ultimately, they will have to contact partners and present even more unreasonable terms, which will have a significant negative impact on the company's profits. 13. If OTC is activated, the volume held by general users will be dominated by Market makers, Venture Capitalists (VCs), and exchanges looking for prey, causing the situation to unfold exactly the opposite of the true intention. 14. The toxic clauses in the IPO are also problematic, and the influence of MMs, VCs, and exchanges holding the tokens will be strong. 15. Stuck in negative sentiment and fine-tuning since the TGE, the team is completely unable to move forward to the next stage. Furthermore, situations that are bound to create more problems are persisting. 16. The team must admit that an ideal paradise does not exist in this world. Having been in a high position for so long, it seems their direct communication with users and marketing strategies are completely out of sync. I'm dumbfounded every time I look at the price lol. Are they planning to list on Upbit and Bithumb, commit crimes, and be done with it? lol
BP
5.1%
loading indicator
Loading..