Drift Protocol Investigates $200M+ Vault Drain Incident

Platform halts deposits as multi-asset outflows hit Solana DeFi system

TL;DR

• Drift flagged suspicious activity and told users to halt deposits.
• Estimated losses range from $200M to $270M across multiple assets.
• Funds moved through swaps, bridges, and exchanges into ETH positions.

We’ve launched the all-new COIN360 Perp DEX, built for traders who move fast!

Trade 130+ assets with up to 100× leverage, enjoy instant order placement and low-slippage swaps, and earn USDC passive yield while climbing the leaderboard. Your trades deserve more than speed — they deserve mastery.

Drift Protocol said it was “experiencing an active attack” on its platform and suspended deposits and withdrawals while the situation was assessed. The protocol issued a public warning stating, “We are coordinating with multiple security firms, bridges, and exchanges to contain the incident. This is not an April Fools joke,” as activity linked to its vaults began drawing scrutiny. The platform did not confirm a final loss figure at the time of the statement, while reports described the incident as a suspected exploit affecting multiple product lines on Solana.

Estimates compiled from onchain tracking and multiple reports placed the suspected outflows at at least $200 million and as high as roughly $270 million, with the latest available figures treated as the most complete representation of the event. 

Activity traced to Drift’s vault addresses showed rapid movements across several tokens, with one vault’s balance dropping from $309 million to $41 million within minutes. The movements involved more than 15 different token types, indicating a broad extraction of collateral rather than a single-asset withdrawal.

Detailed transaction data showed large transfers including 41.721 million JLP valued at $155.62 million, alongside 51.616 million USDC worth $51.62 million. Additional outflows included 164.349 cbBTC valued at $11.29 million and 125,000 WSOL worth $10.45 million, followed by another 8 million USDC worth $8 million. Other assets moved included 2,201 WETH valued at $4.69 million, 45,292 dSOL worth $4.47 million, and 63.467 WBTC valued at $4.36 million, as the flow of funds continued across multiple token categories.

Further transfers captured smaller but notable movements, including holdings in MSOL, BSOL, INF, and JitoSOL, along with multiple USDT transactions totaling about $5.65 million. Additional tokens included 23.366 million FARTCOIN worth $4.11 million and 2.865 million SYRUPUSDC valued at $3.32 million. Onchain data identified one primary receiving wallet accumulating the assets, while a separate transfer of 125,000 WSOL was routed to another unlabeled address connected to the broader flow pattern.

Timeline data indicated the suspected exploit activity began around 4:00 p.m. UTC, when approximately $155 million in JLP was first transferred out of a Drift vault. The affected products included JLP Delta Neutral, SOL Super Staking, and BTC Super Staking vaults, suggesting multiple segments of the protocol were involved. Total value locked on the platform was reported at about $550 million at the time of the incident, based on available DeFi tracking data.

Tracking of post-exploit activity showed assets being swapped into USDC via Jupiter and bridged to Ethereum, where they were used to acquire ETH. One report recorded holdings of 19,913 ETH valued at about $42 million as of 17:45 UTC, while another noted the acquisition of more than $82 million worth of ETH through subsequent transactions. Additional activity included deposits of SOL into Hyperliquid and Binance accounts, as funds continued to move across chains and trading venues.

Market reaction followed quickly, with the DRIFT token falling nearly 5% to $0.064 and briefly trading as low as $0.054 based on COIN360 data tracking the crypto price index and broader coin market cap movements. 

Community commentary included a statement from Helius CEO Mert Mumtaz, who wrote, “not 100% fully certain yet, but it seems drift might be getting exploited,” as users reported irregular behavior linked to their positions during the event.

Separate disclosures confirmed that DeFi Development Corp. had no exposure to Drift Protocol and did not rely on it for treasury operations or yield generation. The company stated it had “zero direct or indirect exposure” to the platform and reiterated its strategy focused on accumulating and staking SOL while operating validator infrastructure.

This article has been refined and enhanced by ChatGPT.