DeFi exchange Drift Protocol confirmed on Thursday that it indeed suffer a highly sophisticated exploit a few hours ago. The amount lost to the attack was over $280 million, the Solana-based platform said, noting that it is working with lawenforcement agencies to track and freeze the stolen assets.
In a step-by-step decoding of the attack, Drift said that the atatckers used a Solana transaction feature called “durable nonces” to pre-sign administrative transfers. This process was done weeks before the attack was launched on April 1. At the time of the attack, this helped the attackers bypass Drift’s sulyi-sig security within minutes.
At least two out of five miltisig signers were accessed by the hackers, Drift noted.
“This attack was enabled by a combination of compromised of multiple multisig signers’ approvals, likely through targeted social engineering or transaction misrepresentation,” the statement from the DeFi exchange claimed. “This was not the result of a bug in Drift’s programs or smart contracts. There is no evidence of compromised seed phrases.”
For now, all funds deposited into valuts and for trading have been impacted by the attack. For the time being, Drift has suspended all of the protocol functions. The compromised wallet, meanwhille, has been removed as well and the signatures hhave been changed.
The protocol is working with on-chain intelligence firms, law enforcement agencies, and crypto bridges to get to the bottom of the attack.
Reports claim that North Korea’s DPRK group could be responsible for the breach, although, confirmation remains awaited.
Drift is yet to disclosed how many users were affected by the breach and what its reimbursement plans look like. In addition, the platform has also not specified a timeline by which it would re-start its suspended services.