Drift Protocol hack: admin takeover wey get DPRK link drain $285M via fake CVT

Drift Protocol hack catch Solana DeFi on Apr 1, 2026 wey dem drip about $285M — pass 50% of Drift TVL. Later report talk say how attacker dey act fit dey similar to DPRK-linked groups, but them never officially confirm who do am. No be normal smart-contract exploit — this hack na governance and privileged access cause am. Dem talk say attackers spend months to build trust, den misuse Solana “durable nonces” make Security Council members sign pre-authorised admin transactions. Drift also change to 2/5 multisig with zero timelock, reduce the window wey people fit intervene. With admin control, attackers whitelist one fake collateral token (CVT) wey get artificial price and no real value. Dem inject 500M CVT and comot real assets like USDC and SOL, plus ETH and other tokens. Report show drains include USDC (~$71.4M), JLP (~$159.3M), cbBTC (~$11.3M), USDT, USDS, WETH, dSOL, WBTC, FARTCOIN, and JitoSOL. The withdrawals and drain run for about 2.5 hours, then dem swap and bridge assets off Solana. The wahala spread: at least 20 Solana protocols reportedly pause or lose money because of composability risk. As of early Apr 3, no confirmed public plan to fully reimburse victims. For traders, the main signal be say operational and governance compromise fit cause quick, wide liquidity shock — often worse than single token volatility. Expect short-term volatility pressure on DRIFT and tighter risk controls across Solana derivatives until governance recover and collateral integrity clear.