Drift suspended deposits as a nine-figure attack unfolded

Drift Protocol said on April 1, 2026 that it was experiencing an active attack and suspended deposits and withdrawals, turning unusual transfers from one of Solana’s largest trading applications into a confirmed protocol emergency.

The event-day record was still developing. Drift’s first public notice said it was investigating unusual activity and warned users not to deposit. A subsequent notice said deposits and withdrawals had been stopped while the team coordinated with security firms, bridges and exchanges. Drift had not yet published a final loss calculation or a verified technical cause.

That distinction matters. On April 1, the confirmed development was the shutdown and the apparent removal of assets; the mechanism, the amount ultimately lost and the attacker’s identity remained unsettled.

What the chain showed on April 1

The Block’s report, updated at 2:45 p.m. Eastern on April 1, put observed losses at no less than $200 million and noted that some estimates were near $270 million. It cited a transfer of 41.7 million JLP tokens valued at roughly $155 million at the time, alongside movements involving SOL, USDC, Coinbase-wrapped bitcoin and wrapped bitcoin.

Those were contemporaneous on-chain estimates, not an audited loss statement. Token prices were moving, wrapped and liquidity-provider assets required valuation assumptions, and investigators were still determining whether every suspicious transfer represented an irrecoverable user loss.

The same report said the suspected operator was converting assets into USDC and moving value toward Ethereum. As of 17:45 UTC, the tracked address held 19,913 ETH valued at about $42 million. That observation was a wallet snapshot at a specified time, not a complete tracing of all funds or proof of who controlled the address.

Why the incident mattered

Drift was a major decentralized venue for perpetual-futures and other leveraged trading on Solana. The Block, citing DeFiLlama during the incident, placed value locked in the protocol above $550 million. A nine-figure drain therefore threatened more than a single token market: it tested the administrative controls, custody assumptions and emergency response around a core piece of Solana’s decentralized-finance infrastructure.

The attack also showed the limits of reading “on-chain” as synonymous with low operational risk. Smart contracts can be publicly inspectable while privileged administration, multisignature approvals, oracle configuration and bridge movements still depend on human procedures and software interfaces. On April 1, however, it was too early to say which of those layers had failed.

No reliable causal market claim can be made from the sources used here. Contemporary reports described declines in DRIFT, but providers used different price windows and the token was trading during a fast-moving security event. The verified institutional consequence was the protocol suspension and the uncertainty imposed on depositors, not a precisely attributable market return.

Questions still open that day

Drift had not established on April 1 whether a contract bug, stolen signing material, deceptive approvals or another path had enabled the transfers. It also had not said which deposits would be recoverable, whether counterparties could freeze assets, or when normal operations might resume. Any stronger conclusion would import later forensic work into the event-day account.

Later context

On April 2, Drift said approximately $280 million had been withdrawn after unauthorized or misrepresented approvals involving Solana durable-nonce transactions enabled a takeover of Security Council powers. TRM Labs later described 31 withdrawals over roughly 12 minutes and assessed a likely North Korean link; that attribution was not established on April 1.

Drift’s April 16 recovery update subsequently itemized stolen assets at $295,706,374.93. That later issuer calculation superseded early estimates for retrospective loss accounting, but it does not change what was verifiable while the attack unfolded on April 1.