Drift Protocol Gets 'Drifted': $285M Gone, Admin Keys to Blame, Circle Snoozes While USDC Vanishes

Solana's Drift Protocol got absolutely wrecked on Wednesday, confirming an exploit that drained somewhere between $270 million and $285 million in user funds. The perp futures DEX halted deposits and withdrawals immediately, coordinating with security firms and exchanges to contain the damage. "This is not an April Fools joke," the team tweeted, because apparently someone at 3 AM thought the timing was hilarious. Nothing says "trust us with your life savings" quite like a exploit dropping on a holiday weekend—peak calendar optimization by the universe.

On-chain data from multiple analytics firms, including PeckShield and Arkham Intelligence, tracked the loot flowing to a single wallet starting at 11:06 AM. Roughly 41 million JLP tokens worth $155 million left the Drift vault first, followed by aundry assortment of stables, wrapped assets, and memecoins. Total transfer estimates hit $250 million, with PeckShield putting the ceiling at $285 million. For those keeping score at home, that's roughly the GDP of a small island nation—or in crypto terms, roughly three days of normal market volatility.

So how did it happen? Not a smart contract bug this time. Blockchain security experts say the attackers exploited Solana's durable nonce feature—legitimate transaction infrastructure meant to enable offline signing and complex workflows. The attackers used pre-signed transactions to seize admin access and drain the vaults. In plain speak: someone left the keys under the doormat, and some sophisticated actor found them. Classic "my keys, my coins" energy—except in this case, the keys were apparently magnetized to any passing opportunist with a blockchain browser and a dream.

Drift's native token cratered 28% on the news, from $0.069 to $0.049. The token now trades 98% below its November 2024 all-time high of $2.60. For the degens who bought at ATH, this is less of a dip and more of a geological event—specifically, the part where the ground opens up and swallows everything.

But the real story might be Circle's response—or lack thereof. On-chain sleuth ZachXBT lit up the stablecoin issuer publicly, noting that millions in USDC sat in transit between Solana and Ethereum via Circle's Cross-Chain Transfer Protocol for hours without intervention. "Circle was asleep while many millions of USDC was swapped via CCTP from Solana to Ethereum for hours from the 9 figure Drift hack during US hours," he posted. Circle previously froze 16+ business hot wallets earlier in the week, leading to questions about why they couldn't—or wouldn't—act faster when hundreds of millions were on the line. Imagine having a fire extinguisher, watching your neighbor's house burn, and then explaining you were "reviewing your freeze policy."

Drift Protocol had around