Unchained How Solana's Largest Perp DEX Was Exploited for $285 Million
Apr 4, 2026
Omer Goldberg, founder and CEO of Chaos Labs and DeFi security analyst, breaks down the $285M Drift Protocol exploit. He walks through how an admin-key compromise, supply-chain trusts, fake collateral and a Solana nonce trick let attackers quietly escalate access. The conversation also covers slow responses, contagion to vaults and whether the attack bears state-linked fingerprints.
AI Snips
Chapters
Transcript
Episode notes
New Multisig With No Time Lock Enabled Immediate Compromise
- Drift migrated an admin role to a 2-of-5 multisig with zero time lock shortly before the exploit.
- That 2-of-5 multisig and lack of delay let the attacker execute immediate sensitive changes when they signed two transactions seconds apart.
Methodical Multiweek Attack Used Fake Collateral To Drain Vaults
- The attacker prepared a multi-step, patient exploit lasting weeks rather than a single opportunistic theft.
- They created a fake token and waited, then used signed transactions to deposit collateral, pump price, and extract blue-chip assets from Drift vaults.
Oracle And AMM Manipulation Turned Scam Token Into Infinite Credit
- The attacker whitelisted the fake CBT token as collateral and chose the oracle feeding its price, then pumped a low-liquidity AMM to inflate collateral value.
- Drift treated the inflated price as real collateral, granting massive credit used to withdraw funds across integrations.