Drift Protocol Suffers $200 Million Exploit in Largest Solana DeFi Attack Since Wormhole

Solana-based decentralized trading platform Drift Protocol confirmed on April 1, 2026 that it was investigating “unusual activity” on its protocol, with onchain data indicating losses of at least $200 million—and some estimates placing the figure closer to $270 million—in what would rank as the largest DeFi exploit on Solana since the $326 million Wormhole bridge attack in 2022.

The protocol halted deposits and urged users not to deposit funds while coordinating with security firms, bridges, and exchanges to contain the incident.

Exploit Targets Multiple Drift Vaults with Estimated Losses up to $270 Million

The exploit began over two hours prior to the protocol’s public announcement and appeared to target multiple Drift vaults, including JLP Delta Neutral, SOL Super Staking, and BTC Super Staking. Onchain data showed one large transfer of 41.7 million JLP tokens worth approximately $155 million, while other assets including SOL, USDC, cbBTC, and wBTC were also drained from the platform.

Blockchain analytics firm Lookonchain found evidence that the exploiter began swapping stolen assets into USDC using Jupiter, the Solana-based decentralized exchange aggregator, and was bridging those stablecoins onto Ethereum to purchase ETH. As of 17:45 UTC on April 1, the attacker held 19,913 ETH, valued at approximately $42 million.

Arkham Intelligence data indicated that over $250 million had moved from Drift to an interim wallet before being distributed to various other addresses, with less than $600,000 remaining in the primary address at press time. The main exploiter address, beginning with HkGz4Kmo, appeared to have been created eight days prior to the attack, conducting small swaps on OKX and Jupiter DEXes before remaining inactive until 18 hours before the exploit.

Protocol Confirms Active Attack as DRIFT Token Declines and Deposits Halted

Drift Protocol posted on X that it was observing unusual activity on the protocol and investigating, explicitly stating that the situation was “not an April Fools joke” and urging users to proceed with caution. The protocol later confirmed an “active attack” and announced it had suspended withdrawals and deposits while coordinating with multiple security firms, bridges, and exchanges.

The DRIFT token declined nearly 5% to $0.064 following the exploit announcement, according to The Block’s data, though onchain data showed the token had fallen over 20% in the hours immediately following the initial reports. Solana’s SOL price fell during the incident but recovered after hitting a localized bottom at $83.82, trading up over 1% on the day.

Helius CEO Mert Mumtaz, whose firm provides infrastructure services to Solana developers, stated that while not 100% certain, it appeared Drift might be getting exploited, raising concerns about the impact on user funds and the broader Solana DeFi ecosystem.

Drift Protocol Positioned as Core Solana Perpetuals Platform with Over $550 Million TVL

Drift Protocol is a decentralized, open-source trading platform built on Solana, widely considered a core component of the Solana ecosystem for perpetual futures trading. According to DeFi Llama, the protocol had total value locked exceeding $550 million prior to the exploit.

The attack would rank as one of the largest onchain crypto hacks in the leaderboard tracked by Rekt and potentially the largest Solana-based exploit outside the $326 million Wormhole bridge attack that occurred in February 2022. Drift stated it would provide additional updates from its official X account as its investigation progressed.

FAQ

How much was stolen in the Drift Protocol exploit?

Onchain data indicates losses of at least $200 million, with some estimates placing the figure closer to $270 million. The attack targeted multiple vaults including JLP Delta Neutral, SOL Super Staking, and BTC Super Staking, with one transfer of 41.7 million JLP tokens alone valued at approximately $155 million.

What has Drift Protocol done in response to the exploit?

Drift Protocol suspended deposits and withdrawals while coordinating with security firms, bridges, and exchanges to contain the incident. The protocol confirmed it was investigating “unusual activity” and later characterized the situation as an “active attack,” urging users to proceed with caution and promising additional updates.

How does this exploit compare to previous Solana DeFi attacks?

The Drift exploit would rank as the largest DeFi attack on Solana since the $326 million Wormhole bridge exploit in 2022, according to Rekt’s leaderboard. The attacker has begun swapping stolen assets into USDC via Jupiter and bridging funds to Ethereum to purchase ETH, with the exploiter address having been created eight days prior to the attack.