alt.hn

4/3/2026 at 5:29:21 PM

Solana Drift Protocol drained of $285M via fake token and governance hijack

 https://anonhaven.com/en/news/drift-protocol-hack-285-million-solana/

by anonhaven

4/3/2026 at 6:17:53 PM

> The attacker used social engineering to induce Drift Security Council multisig signers into pre-signing transactions that appeared routine but carried hidden authorisations.

So much for the "Security Council". What an embarrassment to be in a team/org like that and fail your most basic duty which would be "look at what you sign".

by embedding-shape

4/3/2026 at 6:30:56 PM

That was inevitable, and all designs like that will eventually yield the same outcome.

The people who should be embarrassed are the ones who thought having a group of humans routinely review (possibly complex) transactions for correctness, with no ability to undo/revert the outcome, was a good idea.

by lokar

4/3/2026 at 6:34:00 PM

Also, how could one reasonably disprove that the signers were not in on the scam?

by lokar

4/3/2026 at 6:46:36 PM

That’s the best part, you can’t!

by bombcar

4/3/2026 at 7:31:55 PM

This is conveniently suspect, no? “Drift migrated its Security Council on March 27 to a new 2-of-5 threshold with zero timelock. That eliminated the delay that would have allowed detection before admin actions took effect.” This was after the perp started working on the heist earlier in the month.

by sebgan

4/3/2026 at 8:32:26 PM

> 2-of-5

Just to be sure... They need less than half of the Security Council to approve it?

by gus_massa

4/3/2026 at 9:28:54 PM

If it's a "time-safe" kind of thing, 2-of-5 is common. No one person can open it, but any two can.

by bombcar

4/4/2026 at 5:19:17 AM

[dead]

by solguarddev

4/3/2026 at 9:35:14 PM

[dead]

by solguarddev

4/3/2026 at 10:03:56 PM

This exactly why I hate communism.

by bit1993

4/3/2026 at 6:34:36 PM

The multisig UI/UX is a real and long term difficulty for any governance council. "Please sign this opaque transaction with binary data, it represents our agreement. I promise." For a while maybe ten years ago I worked with MakerDAO on this problem - at the time the idea was a separate auditor for proposed transactions.

This general attack pattern is: get a lender with good collateral to call your bad collateral good, then swap collaterals, and it's a known and bad attack vector; the ongoing tension between innovation / speed and caution continues.

There's probably a flash-loan multiplier angle here for an even worse attack; I'm imagining chaining a liquidity change in the trusted price oracle for the CVT token in the middle of the swapping. Anyway, upshot - don't loan against North Korean attack tokens. Put it on the list.

by vessenes

4/3/2026 at 9:34:36 PM

[dead]

by solguarddev

4/4/2026 at 12:41:05 AM

[dead]

by solguarddev

4/3/2026 at 6:22:23 PM

> The funds were used to deploy CarbonVote Token (CVT), a completely fictitious asset

Crypto calling out other cryptos, made me giggle

by estetlinus

4/3/2026 at 6:39:04 PM

+ "ZachXBT publicly criticised Circle for not freezing the stolen USDC during the bridge"

calling for this, when the whole concept is to avoid government control

by rvnx

4/3/2026 at 6:55:08 PM

Backed stablecoins aren't some anarchistic anti-government thing; they are highly regulated and will lose access to their banking if they don't follow the rules – rules which require them to freeze coins in cases of crime.

If you want to show a middle finger to government there are cryptocurrencies for that, but USD stablecoins with centralized backing is not it.

by haakon

4/3/2026 at 7:38:48 PM

Remind me again how cryptocurrency is the future of money, and is definitely not used, primarily, for scams

by fnoef

4/3/2026 at 7:53:39 PM

I don't see the contradiction, money has always been a scam.

by __MatrixMan__

4/3/2026 at 6:20:08 PM

So this is the end of the Drift project, right?

Back at the top of the crypto hype cycle I wouldn't be surprised to see a project survive even a situation like this one, but now that the hype has died down is it still possible to come back from a loss of this magnitude?

by simonw

4/4/2026 at 10:58:44 AM

[dead]

by solguarddev

4/3/2026 at 8:54:00 PM

Say what you want about cryptocurrency, at least their bug bounties pay well.

by stavros

4/3/2026 at 6:23:19 PM

It feels like main purpose of those various coins are scams. Either classic pump and dump, or advanced ones based on complex interactions.

by rvba

4/3/2026 at 6:03:48 PM

Their CEO should serve prison time for being so incompetent but hey c-levels almost never get punished which is sad.

by edm0nd

4/3/2026 at 6:24:59 PM

this is a beautiful attack, the way that multisig signers were compromised with innocuous signatures in advance, without really compromising private keys

from the pre-funding to a virgin address, to the bundler, to the exit strategy to decentralized assets

to the protocols exposed but functioning perfectly under the stress test - props to Jupiter! - and the optional insurance protocols functioning decently, all while people point fingers at Circle for their bridge working perfectly, it's not even clear what people want them to do specifically! All of these aspects of web3 are working great, and it's easy for a cynic that only sees these headlines to miss that

inspirational, great place to build

by yieldcrv

4/4/2026 at 5:08:26 AM

[dead]

by solguarddev

4/4/2026 at 1:25:31 AM

[dead]

by solguarddev

4/3/2026 at 6:36:22 PM

It took a long time until we got real digital money, Bitcoin.

But all these new protocols want to do stuff at the expense of trustlesssness.

by maipen

4/3/2026 at 7:15:48 PM

Bitcoin isn't 'real digital money'. It's a speculative asset for gambling with. That's all it is, and all it ever was.

by Night_Thastus

4/3/2026 at 8:24:22 PM

It was also briefly useful for buying drugs on the Internet.

It also enabled the existence of ransomware. Can't go big fish hunting if there is no viable way to pay the attacker.

All Bitcoin/crypto "currency" is harm with near-zero upside.

by selectively

4/3/2026 at 6:29:41 PM

Is public-permissionless just a bad fundamental?

by verdverm

4/3/2026 at 8:11:20 PM

Alright, time to fork this bitch.

by kernal

4/3/2026 at 7:05:19 PM

What a nice retirement fund!

by youniverse

4/3/2026 at 6:15:58 PM

What kind of DeFi protocol has super power private keys to alter the protocol just like that? And no timelock. Seriously? What a joke

by Overpower0416

4/3/2026 at 6:23:25 PM

Seems to be very standard now a days as projects seek to do things that can't be done fully on-chain.

You'd think they'd take a step back and ask "why is this even a token then?".

by KK7NIL

4/3/2026 at 6:31:52 PM

All changes should be voted upon no matter if onchain or offchain. After that there should be a timelock, so people that don't agree with the vote to pull their assets if they want to. The only power these private keys should have is to pause the market if there is a major bug or exploit.

by Overpower0416

4/4/2026 at 11:06:27 AM

[dead]

by solguarddev

4/3/2026 at 6:32:52 PM

It's a token so they can make $

by lokar

4/3/2026 at 6:20:11 PM

Hyperliquid.

by andxor

4/4/2026 at 2:58:52 PM

[dead]

by solguarddev

4/4/2026 at 6:58:30 PM

[flagged]

by solsafe_dev

4/3/2026 at 5:42:32 PM

[flagged]

by solguarddev

4/4/2026 at 5:28:33 PM

[flagged]

by solsafe_dev

4/3/2026 at 6:05:49 PM

[dead]

by fred_is_fred

4/3/2026 at 7:08:16 PM

It's always entertaining to see worthless idiots lose money on an obvious scam like cryptocurrency. Ha ha. Although in this case it seems that North Koreans might have ended up with actual valuable fiat currency, which is unfortunate.

by nradov