Drift Protocol $285M Solana DEX Infiltration Attributed to UNC4736
Drift Protocol said its Solana-based DEX was hit by a structured six-month intelligence operation, attributed with “medium-high confidence” to UNC4736. The attackers posed as a quantitative trading firm, coordinated via Telegram, and met contributors in person before building a working Ecosystem Vault inside Drift and triggering the exploit.
Drift Protocol reported the intruders deposited over $1M to gain trust, then drained about $285M. Multiple pools were fully emptied, including USDC, USDT, and ARB-related liquidity, plus wrapped assets like WETH, WBTC, wBNB, wbETH, and wstETH. During the incident, Drift paused deposits and withdrawals.
On the technical side, Drift Protocol pointed to potential entry paths such as a cloned vault frontend repository and a possible malicious TestFlight app, plus a VSCode/Cursor-related vulnerability that could enable silent code execution. Drift added that it froze remaining platform functions, removed compromised wallets from its multisig, and flagged accounts with exchanges and bridge operators.
For traders, the key takeaway is that Drift Protocol highlights a shift toward “intelligence-unit” style attacks targeting contributors, dev tools, and signer environments—raising focus on transaction-intent checks and multisig security rather than only smart-contract audits.
Neutral
This is a major DeFi security incident, but the direct asset price impact is unlikely to be large because the report is focused on Drift Protocol’s specific platform and drained liquidity rather than a systemic Solana protocol failure. In the short term, the $285M loss and paused deposits/withdrawals can increase risk aversion and tighten liquidity for SOL-linked activity, especially for traders dealing with multisig/signer workflows. Over the longer term, the broader industry response—urgent audits, signer hardening, and stronger transaction-intent validation—could stabilize sentiment. Overall, the news is more likely to affect DeFi confidence and operational security practices than to drive a sustained SOL price trend on its own.