In the wake of a devastating $270 million exploit of the Drift Protocol, a decentralized finance platform on the Solana network, the Solana Foundation has unveiled a robust suite of security measures. The announcement comes just five days after the hack, which was carried out by a North Korean state-affiliated group following a six-month-long social engineering campaign.
At the forefront of the initiative is Stride, a structured evaluation program led by Asymmetric Research, which will assess Solana DeFi protocols against eight key security pillars and publicly disclose its findings. Additionally, the Solana Foundation has introduced the Solana Incident Response Network (SIRN), a membership-based group comprising security firms and researchers focused on providing real-time crisis response. While these initiatives address some of the vulnerabilities exposed by the Drift hack, they do not directly address the human element that led to the exploit.
The attackers had spent six months building relationships with Drift contributors and compromised their devices through a malicious code repository and a fake TestFlight app, ultimately exploiting the trust between individuals rather than any technical vulnerabilities in the smart contracts. Under the Stride program, protocols with more than $10 million in total value locked (TVL) that pass the evaluation will be eligible for ongoing operational security and active threat monitoring, funded by Solana Foundation grants. The level of coverage will be tailored to each protocol's specific risk profile. For larger protocols with over $100 million in TVL, the foundation will also provide funding for formal verification, a rigorous mathematical method that verifies every possible execution path in a smart contract to ensure its correctness.
The founding members of SIRN include Asymmetric Research, OtterSec, Neodyme, Squads, and ZeroShadow, with the network being made available to all Solana protocols, prioritized based on their TVL. It is worth noting that the formal verification process under Stride would not have prevented the North Korean attack, which relied on compromised devices to obtain multisig approvals that were then locked into durable nonce transactions and executed weeks later. Similarly, 24/7 monitoring of on-chain activity would not have detected the attack, as the transactions were designed to appear legitimate and were indistinguishable from administrative actions until they were used to drain the vaults. The attack exploited the gap between on-chain correctness and off-chain human trust, a vulnerability that current smart contract audits and monitoring tools are not equipped to address.
However, the Solana Incident Response Network could have potentially mitigated the aftermath of the attack. The lack of swift response from stablecoin issuer Circle Internet (CRCL) in freezing over $230 million of stolen USDC during the six-hour window following the attack has been criticized by on-chain security expert ZachXBT. A dedicated incident response network with established relationships between bridge operators, exchanges, and stablecoin issuers might have shortened the response time, although it is uncertain whether it would have been sufficient to prevent the subsequent Wormhole bridging and obfuscation through Tornado Cash. The Solana Foundation has emphasized that these programs do not absolve protocols of their underlying responsibility for security, a point that takes on added significance in light of the Drift postmortem, which revealed that individual contributor devices were the entry point for the nation-state attack.
Solana already offers several free security tools for developers, including Hypernative for threat detection, Range Security for real-time monitoring, and Neodyme's Riverguard for attack simulation.