The Drift Protocol attack was not a traditional hack, as it did not involve a bug in the code or a cracked private key. Instead, the attacker utilized Solana's 'durable nonces' feature to trick Drift's security council into pre-approving transactions that would be executed at a later time, resulting in the loss of at least $270 million. The attack took less than a minute to execute but over a week to set up. Durable nonces are a legitimate Solana transaction feature that replaces the expiring blockhash with a fixed 'nonce', allowing transactions to remain valid indefinitely.
However, this feature can be exploited if an attacker can obtain signatures from multiple council members, which is what happened in the case of Drift Protocol. The attacker created durable nonce accounts and obtained signatures from two council members, which were then used to execute the malicious transactions.
The attack highlights the importance of operational security and social engineering in DeFi protocols, as the human layer around the multisig was compromised, allowing the attacker to separate the moment of approval from the moment of execution. The protocol has been frozen, and the compromised wallet has been removed from the multisig, but the incident raises questions about how to defend against such attacks in the future.