The drift protocol hack happened because the people and processes meant to prevent it were quietly dismantled over three weeks and nobody noticed until $285 million was already gone.
On April 1, 2026, attackers drained Drift Protocol, the largest decentralized perpetual futures exchange on Solana, in an hour or less. By the time the protocol’s team confirmed the breach, most of the stolen funds had already been bridged to Ethereum. TRM Labs, the blockchain intelligence firm that first covered the incident, linked the attack to North Korean state-sponsored hackers.
However, the more important thing is not who did it but is how and what it reveals about the gaps that still exist across the DeFi compliance landscape.
The Drift Protocol Hack Was a Result of Social Engineering
Most people imagine a crypto hack as someone breaking through a wall. The drift protocol hack was the opposite. According to Chainalysis, attackers spent months building relationships with the Drift team before the attack took place. Apparently, they did not break in, they were actually let in.
Using a legitimate Solana feature called durable nonces which allow transactions to be signed in advance and executed days or weeks later, the attackers convinced real Security Council members to pre-sign transactions that appeared routine.
Those transactions actually transferred full administrative control of the protocol to the attackers.
Three Weaknesses the Drift Hack Exposed
- The absence of an active timelock on governance changes was one of the key weaknesses the Drift Protocol hack exposed. According to TRMLabs, on March 27, just Four days before the attack, Drift moved its Security Council to a zero time lock setup, removing the delay that could have stopped the exploit. If a DeFi protocol cannot show that it uses active timelocks on governance changes, it means updates can be executed immediately without any delay. This removes the window for review, oversight, or user response, increasing the risk of misuse, errors, or malicious actions. For compliance teams, that is a clear red flag and should be flagged as a material risk.
- The attackers created a fake token called CarbonVote (CVT) and seeded it with a few thousand dollars of artificial liquidity, and used wash trading to hold its price near $1.
Drift’s oracles accepted it as legitimate collateral worth hundreds of millions. This is effectively the on-chain equivalent of invoice fraud, manufacturing the appearance of value where none exists.
This is where A&D forensics comes in. A&D Forensics works with crypto exchanges and financial institutions to detect suspicious transaction patterns through blockchain analytics, transaction monitoring, and enhanced due diligence.
- The Drift Protocol incident exposed overreliance on a multisignature security setup without sufficient safeguards around signer access. The protocol used a multisig system to approve critical transactions, meaning no single person could execute a sensitive action alone. Instead, multiple designated signers had to approve before any transaction could be processed.
However, the exploit did not target the multisig system itself. Attackers instead used social engineering to deceive legitimate signers into approving the malicious transaction. Once the required number of approvals was obtained, the multisig executed the transaction exactly as intended.
This is why a multisig on its own is not a sufficient security control. It can prevent a single compromised passkey from executing actions, but it does not prevent a group of authorized signers from collectively making a bad, manipulated, or compromised decision.
Compliance teams must go beyond asking whether a system uses multisig and start asking how signers are trained, how they verify transaction intent, and what process exists for escalating unusual requests.
What This Means for African VASPs and Financial Institutions
According to Help Net Security, North Korean hackers launder stolen funds through DeFi protocols, mixing services, no-KYC exchanges, cross-chain bridges, and Chinese-language payment processors. These funds move fast and cross jurisdictions quickly. For Virtual Asset Service Providers (VASPs), cryptocurrency exchanges, and financial institutions across Africa, exposure to these flows is a real compliance risk.
A&D Forensics traces and investigates blockchain and cryptocurrency-related fraud, helps organisations stay compliant, and trains compliance teams to identify criminal activity on-chain.Â
The drift protocol hack is the kind of multi-layered threat that requires both the right tools and trained investigators to detect.
If your organisation interacts with DeFi protocols, processes crypto transactions, or holds digital assets on behalf of clients, now is the time to review your governance risk exposure, your transaction monitoring coverage, and your team’s ability to spot social engineering before it becomes a breach.
Reach out to A&D Forensics to understand where your gaps are before someone else finds them first.
