The Drift Protocol attack was an unconventional hack that did not involve finding a bug, cracking a private key, or exploiting a flash loan. Instead, an attacker utilized a legitimate Solana transaction feature called 'durable nonces' to pre-sign administrative transfers weeks in advance, circumventing the protocol's multisig security in a matter of minutes. The outcome was the loss of at least $270 million, which took less than a minute to execute but over a week to set up. Durable nonces are a Solana feature designed to override the standard safety feature of expiring blockhashes, allowing transactions to remain valid indefinitely.
This feature is intended for use in hardware wallets, offline signing setups, and institutional custody solutions, enabling them to prepare and approve transactions without being forced to submit them within a short time frame. However, this feature also creates a problem, as transactions can be executed at a later time, potentially without the original signers' knowledge or consent. In the case of the Drift Protocol attack, the attacker obtained two signatures from the Security Council multisig, which were then used to execute malicious transactions.
The attack did not compromise any private keys but instead relied on social engineering tactics to obtain the necessary signatures. The stolen funds were then transferred to various wallets and eventually bridged to Ethereum addresses via Wormhole, a cross-chain bridge. The attack highlights the importance of operational security and the need for protocols to implement robust security measures to prevent such exploits.
The Drift Protocol has since frozen its protocol and removed the compromised wallet from the multisig, and an investigation is underway to determine the extent of the damage and the parties involved.