Daily Edition: Drift Protocol Hacked for $250M+
A compromised admin key allowed attackers to steal hundreds of millions in seconds, over half of all funds held on Drift.
Here is a breakdown of what they did and how it happened 👇
Today might be April Fools but it’s been anything but a joke for Drift Protocol, a major perpetuals exchange on Solana, which suffered a $270M exploit only several hours ago.
Representing about half of the TVL on the platform, it’s unclear exactly how many customer assets might have been affected or how they will proceed from here.
The attack was premeditated, compromising one of the admin keys which gave them full control over market creation, oracles (responsible for setting prices), and withdrawal limits.
They used this power to create a market for their own valueless token called “CVT”, enable borrowing power at 100%, and disable any relevant security measures that could prevent the attack.
The exploiter then set the oracle price to $11 and deposited their worthless tokens, which the exchange now valued at hundreds of millions of dollars.
In just 15 seconds, over $250M was stolen. Most of that amount has now been bridged to Ethereum, with a significant chunk moving through USDC.
As most crypto natives know by now Circle seems not to care about its duties to freeze stolen funds, so the attackers were able to move unencumbered.
Pretty ironic that the most regulated stablecoin company is the most relaxed on crime!
