1 Apr 2026, ~16:05 UTC
Drift Protocol: Durable-Nonce Multisig Approvals Used for Admin Takeover
On 1 Apr 2026 Drift on Solana lost ~$285.3M after pre-signed durable-nonce approvals transferred Security Council admin control. Attacker then inflated fake collateral and withdrew real assets.
- Event date
- Incident typeGovernance / admin compromise
- Bug classAccess control
- Published
Loss, as sourced
Approximately $285.3M ($285,279,417.69), per BlockSec from the attacker's withdrawal account. Drift's initial statement is cited by BlockSec.
Traceability
Primary sources
In brief
Root cause: Per BlockSec citing Drift: two of five Security Council signers pre-signed malicious Squads vault transactions on durable nonces (indefinitely valid); zero timelock. After UpdateAdmin, attacker created CVT collateral, switched oracle, relaxed withdrawal guards, drained via 31 withdrawals in ~12 minutes.
Timeline, as sourced: Per BlockSec: Mar 11 CVT created; Mar 23 durable nonces; Mar 27 council migration; by Mar 30 new durable nonce under updated multisig; Apr 1 ~16:05 UTC two pre-signed txs transfer admin.
Account, as sourced
Per BlockSec (analysis (opens in a new tab)): not a contract bug or key theft — manipulated approvals preserved via durable nonces.
Unknown: Drift's full technical post-mortem (BlockSec notes only an initial statement).
Summaries of public sources as of the published date; except where marked (on-chain), not independently verified by NullMeridian. Figures are the sources’ own and are attributed; where sources disagree, each is given. Sources may since have changed. Not legal, financial or investment advice.
Permalinkhttps://andromeda.observer/e/drift-durable-nonce-admin-takeover-2026