Just five days after the decentralized finance platform Drift Protocol suffered a $270 million exploit at the hands of a North Korean state-affiliated group, the Solana Foundation has unveiled a suite of security initiatives. The centerpiece of this effort is Stride, a structured evaluation program led by Asymmetric Research that will assess Solana DeFi protocols against eight security pillars and make its findings publicly available. Additionally, the foundation has introduced the Solana Incident Response Network (SIRN), a membership-based group of security firms and researchers focused on providing real-time crisis response.
While these initiatives address some of the issues exposed by the Drift hack, they do not directly tackle the human vulnerability that led to the loss. The attackers had spent six months building relationships with Drift contributors and compromised their devices through a malicious code repository and a fake TestFlight app. Under Stride, protocols with more than $10 million in total value locked (TVL) that pass the evaluation will receive ongoing operational security and active threat monitoring funded by Solana Foundation grants. This coverage will be tailored to each protocol's risk profile.
For protocols with more than $100 million in TVL, the foundation will also fund formal verification, a mathematical method that checks every possible execution path in a smart contract to guarantee correctness. The network is available to all Solana protocols but prioritized based on TVL.
Founding members of the network include Asymmetric Research, OtterSec, Neodyme, Squads, and ZeroShadow. The Stride program's formal verification would not have prevented the North Korean attack, which used compromised devices to obtain multisig approvals that were then locked into durable nonce transactions and executed weeks later. Similarly, 24/7 monitoring of on-chain activity would not have caught the attack, as the transactions were valid by design and indistinguishable from legitimate administrative actions until they were used to drain the vaults.
The attack exploited the gap between on-chain correctness and off-chain human trust, a gap that no smart contract audit or monitoring tool is designed to cover. However, the Solana Incident Response Network could have potentially helped with the response.
On-chain security expert ZachXBT criticized stablecoin issuer Circle Internet for failing to freeze over $230 million of its stolen USDC during a six-hour window after the attack began. A dedicated incident response network with established relationships to bridge operators, exchanges, and stablecoin issuers might have shortened the response time. The foundation emphasized that these programs do not transfer the underlying responsibility away from the protocols themselves, a point that takes on added significance in light of Drift's postmortem, which revealed that individual contributor devices were the entry point for a nation-state attack. Solana already offers several free security tools for builders, including Hypernative for threat detection, Range Security for real-time monitoring, and Neodyme's Riverguard for attack simulation.