Overview
- Drift Protocol, which reported an active attack Wednesday, suspended deposits and withdrawals as on-chain trackers flagged $250 million to roughly $285 million moving to a wallet starting with HkGz4K.
- Drift said the breach was not a smart contract bug and involved durable nonce accounts and pre‑signed transactions that let an attacker seize Security Council control under a 2‑of‑5 multisig.
- The team said borrow and lend products, vaults, and trading deposits were drained, while assets not deposited into Drift such as DSOL staked to the Drift Validator were not affected.
- On-chain analysts said the thief split funds, swapped into other tokens, and bridged to Ethereum, including more than $230 million in USDC moved via Circle’s CCTP as critics questioned why the transfers were not frozen.
- Security firms, exchanges, bridges, and law enforcement are assisting, no recovery has been confirmed, and the DRIFT token fell more than 20% as wallet providers warned users to avoid the app during the probe.