On Monday, the Solana Foundation unveiled a series of security measures, just five days after the decentralized finance platform Drift Protocol was hacked for $270 million by a North Korean state-affiliated group, following a six-month social engineering campaign. The centerpiece of the initiative is Stride, a structured evaluation program led by Asymmetric Research, which will assess Solana DeFi protocols against eight security pillars and publicly disclose its findings. Additionally, the foundation introduced the Solana Incident Response Network (SIRN), a membership-based group of security firms and researchers focused on real-time crisis response. While these initiatives address part of the issue exposed by the Drift hack, they do not address the underlying mechanics that led to the loss.
The attackers spent six months building relationships with Drift contributors and compromised their devices through a malicious code repository and a fake TestFlight app. Under Stride, protocols with over $10 million in total value locked (TVL) that pass the evaluation will receive ongoing operational security and active threat monitoring funded by Solana Foundation grants. For protocols with over $100 million in TVL, the foundation will also fund formal verification, a mathematical method that checks every possible execution path in a smart contract to guarantee correctness.
The network is available to all Solana protocols but prioritized by TVL. Stride's formal verification, however, would not have caught the North Korean attack, which used the compromised devices to obtain multisig approvals that were then locked into durable nonce transactions and executed weeks later.
Neither would 24/7 monitoring of onchain activity, because the transactions were valid by design and indistinguishable from legitimate administrative actions until they were used to drain the vaults. The attack exploited the gap between onchain correctness and offchain human trust, a gap no smart contract audit or monitoring tool is built to cover. SIRN, however, could have helped with the response.
A dedicated incident response network with established relationships to bridge operators, exchanges, and stablecoin issuers might have shortened the response time.