Solana-based DeFi platform Drift suffers $285M exploit after attacker gains admin control and drains multiple liquidity vaults.
A major decentralized finance (DeFi) platform built on the Solana blockchain has suffered a massive security breach, with attackers stealing roughly $285 million in digital assets.
The affected platform, Drift Protocol, confirmed it was experiencing an active attack and immediately suspended deposits and withdrawals while security teams investigated the incident.
Blockchain analysts estimate the total value of stolen funds at around $285 million, making the incident one of the largest cryptocurrency exploits of 2026 so far.
According to early forensic analysis, the attacker gained elevated administrative privileges through a complex exploit involving durable nonces and compromised authorization signatures, allowing them to bypass safeguards and drain multiple vaults on the platform.
The hacker reportedly deposited a manipulated token as collateral, which appeared valuable due to price-oracle manipulation. Using this inflated collateral value, the attacker executed rapid withdrawals of real assets from the protocol.
Among the assets stolen were JLP tokens, USDC stablecoins, SOL, and other cryptocurrencies, with a single transfer involving more than 41 million JLP tokens valued at about $155 million.
Blockchain trackers later observed the attacker converting some funds into stablecoins and bridging assets to other networks, including Ethereum, in an effort to obscure the trail and avoid potential freezes.
Following the exploit, Drift’s total value locked dropped dramatically, losing more than half of its liquidity within hours. The platform’s native DRIFT token also fell sharply as investors reacted to the breach.
Security researchers say the incident highlights the growing risk posed by governance and key-management vulnerabilities in DeFi systems, where administrative access can allow attackers to bypass smart-contract protections.
Drift said it is working with security firms, exchanges, and blockchain analytics companies to track the stolen funds and investigate the attack. The platform has not yet confirmed whether any of the assets can be recovered.
Reports are sourced from official documents, law-enforcement updates, and credible investigations.
Discover additional reports, market trends, crime analysis and Harm Reduction articles on DarkDotWeb to stay informed about the latest dark web operations.
