Just five days after the decentralized finance platform Drift Protocol suffered a $270 million exploit at the hands of a North Korean state-affiliated group, the Solana Foundation has announced a suite of security measures. The new initiatives, unveiled on Monday, are designed to bolster the security of Solana DeFi protocols and include a structured evaluation program called Stride. Led by Asymmetric Research, Stride will assess Solana DeFi protocols against eight security pillars, with findings to be published publicly.
Additionally, the Solana Foundation has introduced the Solana Incident Response Network (SIRN), a membership-based group of security firms and researchers focused on real-time crisis response. The SIRN will provide protocols with more than $10 million in total value locked (TVL) that pass the evaluation with ongoing operational security and active threat monitoring, funded by Solana Foundation grants. For protocols with over $100 million in TVL, the foundation will also fund formal verification, a mathematical method that checks every possible execution path in a smart contract to guarantee correctness.
Founding members of the SIRN include Asymmetric Research, OtterSec, Neodyme, Squads, and ZeroShadow, with the network available to all Solana protocols, prioritized by TVL. While the new measures address part of the problem exposed by the Drift exploit, they do not directly address the human vulnerability that led to the loss.
The attackers had spent six months building relationships with Drift contributors and compromised their devices through a malicious code repository and a fake TestFlight app. The vulnerability was not in the smart contracts themselves, which had passed audits, but rather in the human element.
The Stride program's formal verification would not have caught the North Korean attack, which used compromised devices to obtain multisig approvals that were then locked into durable nonce transactions and executed weeks later. Similarly, 24/7 monitoring of on-chain activity would not have detected the transactions, as they were valid by design and indistinguishable from legitimate administrative actions until they were used to drain the vaults.
The attack exploited the gap between on-chain correctness and off-chain human trust, a gap that no smart contract audit or monitoring tool is built to cover. However, the SIRN could have potentially helped with the response to the attack.
On-chain security expert ZachXBT criticized stablecoin issuer Circle Internet (CRCL) for failing to freeze over $230 million of its stolen dollar-pegged USDC during a six-hour window after the attack began. A dedicated incident response network with established relationships to bridge operators, exchanges, and stablecoin issuers might have shortened the response time, although it is unclear whether it would have been fast enough to prevent the Wormhole bridging and obfuscation through Tornado Cash. The Solana Foundation has emphasized that the new programs 'do not transfer the underlying responsibility away from the protocols themselves,' a statement that takes on a different meaning in light of the Drift postmortem, which revealed that individual contributor devices were the entry point for a nation-state attack. Solana already hosts several free security tools for builders, including Hypernative for threat detection, Range Security for real-time monitoring, and Neodyme's Riverguard for attack simulation.