The recent attack on Drift Protocol was a novel form of exploit that did not involve traditional hacking methods such as finding a bug, cracking a private key, or using a flash loan. Instead, an attacker leveraged a legitimate Solana feature known as 'durable nonces' to trick Drift's security council into pre-approving transactions that would be executed at a later time, resulting in the theft of at least $270 million. This feature, designed for convenience, allows transactions to remain valid indefinitely until they are submitted, creating a potential security risk if not properly monitored.
The attacker obtained signatures from two council members, which were then used to execute malicious transactions and gain control of Drift's protocol-level permissions. Onchain researchers tracked the stolen funds in real-time, revealing that the attacker transferred the assets to various wallets and eventually to Ethereum addresses via cross-chain bridges.
The primary concern is not the code itself but the human layer around the multisig, which failed to recognize the potential risks associated with durable nonces. As such, this incident highlights the increasing importance of social engineering and operational security in DeFi protocols.