Signal

Solana-based Drift protocol suffers largest crypto exploit of 2026 with $285 million loss

Evidence first: scan the strongest sources, then decide whether to go deeper.

Published 2026-04-03 06:01 UTCUpdated 2026-04-03 16:35 UTC
redditrsstelegram
crypto_assetschainsdefiexchangeshacks
Source links open
Source links and full evidence are open here. Pro adds archive history, compare-over-time, alerts, exports, and workflow. Business adds Feed API integrations and team usage.
No card needed for the free brief.
Evidence trail (top sources)
top sources (2 domains)domains are deduped. counts indicate coverage, not truth.
2 top sources shown
limited source diversity in top sources
Overview

On April 1, 2026, the Solana-based decentralized exchange Drift Protocol experienced a major security breach resulting in the theft of approximately $285 million in multiple crypto assets.

Entities
Drift ProtocolDRIFTUSDCUSDTWBTCWETH
Score total
2.27
Momentum 24h
8
Evidence documents
-
Independent publishers
-
Independent origins
-
Primary sources
-
Secondary sources
-
Source types
-
Duplicate ratio
13%
Why now
  • Attack occurred recently on April 1, 2026, impacting market confidence in Solana DeFi.
  • Drift’s outreach to stolen fund wallets signals active recovery and negotiation efforts.
  • Discussions on Solana protocol safeguards and DeFi governance security are intensifying post-incident.
Why it matters
  • Largest crypto exploit of 2026 to date highlights ongoing security risks in DeFi.
  • Governance and multisig vulnerabilities pose systemic risks to decentralized exchanges.
  • Potential state-linked hackers targeting crypto infrastructure raise geopolitical and compliance concerns.
LLM analysis
Topic mix: lowPromo risk: lowSource quality: medium
Recurring claims
  • Drift Protocol lost approximately $285 million in a security exploit on April 1, 2026.
  • The exploit involved a social engineering attack using durable nonces to gain administrative control.
  • Drift has reached out to wallets holding stolen funds and linked the hack to North Korea-associated hackers.
How sources frame it
  • Decrypt: neutral
All evidence
Show filters & breakdown
Posts loaded: 0Publishers: 6Origin domains: 6Duplicates: -
Showing 6 / 8
Top publishers (this list)
  • decryptnews (1)
  • Reddit (1)
  • Realnarrativenews (1)
  • Newsbtc (1)
  • Thehackernews (1)
  • Cybernews (1)
Top origin domains (this list)
  • decrypt.co (1)
  • reddit.com (1)
  • realnarrativenews.com (1)
  • newsbtc.com (1)
  • thehackernews.com (1)
  • cybernews.com (1)