Drift Hit by Estimated $200M Solana Exploit, DRIFT Falls 20%

Solana trading platform Drift suspended deposits and withdrawals after a suspected compromised admin key drained vaults for an estimated $200 million or more.

Solana-based trading platform Drift confirmed an active attack on its protocol Wednesday and suspended both deposits and withdrawals, posting on X to warn users against depositing funds while the investigation was underway. According to CoinMarketCap, losses are estimated at a minimum of $200 million, with some on-chain data placing the figure closer to $270 million. Blockchain security researcher Vladimir S said the most likely cause was a compromised admin signer key, and the attacker used that access to drain multiple Drift vaults, including JLP Delta Neutral, Solana Super Staking, and Bitcoin Super Staking.

The exploit began more than two hours before Drift posted its public alert, and Helius CEO Mert Mumtaz wrote on X that Drift appeared to be getting exploited before the platform had confirmed the breach. A single transfer of 41.7 million JLP tokens was worth approximately $155 million on its own, with other drained assets including Solana, USDC, cbBTC and wBTC per SolScan data.

CoinMarketCap reports that on-chain data from Arkham showed more than $250 million moving from Drift to an interim wallet before being split across multiple addresses. Tracking firm Lookonchain found the attacker began converting stolen funds to USDC through Jupiter, then bridged those stablecoins to the Ethereum network and used them to purchase ETH. By 5:45 p.m. UTC Wednesday, the attacker held approximately 19,913 Ethereum, worth around $42 million. The market reaction was immediate: the DRIFT token dropped more than 20% to around $0.05, after briefly reaching $0.68 earlier in the day, while Solana hit a local low of $83.82 before partially recovering and staying up over 1% on the day.

If losses are confirmed at or above $200 million, CoinMarketCap reports the attack would rank as the largest exploit on Solana outside the $326 million Wormhole bridge hack, according to Rekt's leaderboard. The reputational damage may outlast the financial hit: Immunefi has reported that roughly 83% of native tokens from hacked platforms never recover to their pre-hack price levels, and its CEO Mitchell Amador said in March that confirmed exploits also bring token price suppression, reduced treasury capacity and erosion of user trust. Drift said it would continue posting updates from its official X account as the investigation progresses.