Drift Protocol on Solana Reportedly Exploited for More Than $200 Million

Drift Protocol’s roughly $285 million April 1 exploit has drawn new scrutiny to Circle after on-chain investigator ZachXBT said attackers bridged more than $230 million in stolen USDC from Solana to Ethereum through Circle’s Cross-Chain Transfer Protocol across more than 100 transactions without interruption. The attack, which Drift said stemmed from a Security Council compromise involving durable nonce-based multisig approvals rather than a bug in its Solana programs, drained major vaults including JLP Delta Neutral, SOL Super Staking, and BTC Super Staking and cut total value locked from over $550 million to under $250 million, according to DeFiLlama. Critics contrasted Circle’s lack of action during the exploit with its March 23 freezing of 16 unrelated corporate hot wallets in a separate civil matter, while Dune Analytics data cited in the report said Circle has blacklisted about $117 million across 601 wallets. Elliptic and Diverg said the laundering pattern and network-level indicators align with North Korean activity, and Diverg said TRM Labs and Elliptic linked the attack to Lazarus Group, though Drift said only that it had identified critical information about the parties involved.