Solana-Based Drift Secures $148 Million From Tether and Partners, Plans USDT-Based Relaunch

Drift Protocol is a major decentralized perpetual futures exchange in the Solana ecosystem, allowing users to deploy assets in trading, lending and vaults. The attack was not simply a smart-contract exploit but a prolonged infiltration targeting governance multisig controls and trust in personnel. More than half of the protocol's total value locked was affected, highlighting operational security risks in DeFi.

On April 1, 2026, the attackers seized control of Drift's multisig and transferred assets within 10 seconds. The loss estimate was raised from an initial range of $136 million to $220 million to $285 million, including $155.6 million in JLP, while DRIFT fell more than 30%. Drift said on April 5 that UNC4736, a North Korea-linked group, had posed as a quantitative trading firm since the fall of 2025, infiltrating the protocol for six months and using Durable Nonce to bypass its multisig.

Drift is a major decentralized perpetual futures and lending platform on Solana, where users deposit assets as trading collateral. The attacker did not exploit a software vulnerability. Instead, social engineering was used to secure approval from the Security Council multisig before Solana's “durable nonce” mechanism was abused to seize administrative control, highlighting the human signing and governance risks facing DeFi platforms.

Drift confirmed the attack and suspended deposits and withdrawals on April 1, 2026. Its April 16 assessment put stolen assets at $295.7 million, including about $159.3 million in JLP and about $71.42 million in USDC. In a June 4 update, Drift said Mandiant had attributed the attack to North Korean group UNC6862. The platform remained under reconstruction, while partners including Tether planned to provide up to $147.5 million in recovery support.