Solana Foundation Introduces Comprehensive Security Enhancements Following $270 Million Drift Hack

Just five days after the decentralized finance platform Drift Protocol suffered a $270 million exploit at the hands of a North Korean state-affiliated group, the Solana Foundation has announced a suite of security measures. The centerpiece of this initiative is Stride, a structured evaluation program led by Asymmetric Research that will assess Solana DeFi protocols against eight security pillars and publish its findings publicly. Additionally, the foundation has introduced the Solana Incident Response Network (SIRN), a membership-based group of security firms and researchers focused on real-time crisis response.

These initiatives address part of the problem exposed by Drift but do not directly tackle the mechanics that led to the loss. The attackers had spent six months building relationships with Drift contributors and compromised their devices through a malicious code repository and a fake TestFlight app. Under Stride, protocols with more than $10 million in total value locked (TVL) that pass the evaluation will receive ongoing operational security and active threat monitoring funded by Solana Foundation grants.

For protocols with over $100 million in TVL, the foundation will also fund formal verification. The network is available to all Solana protocols but prioritized by TVL. The introduction of Stride's formal verification and SIRN could enhance the security posture of Solana DeFi protocols, although it would not have prevented the North Korean attack. The attack exploited the gap between onchain correctness and offchain human trust, a gap no smart contract audit or monitoring tool is designed to cover.

However, a dedicated incident response network could have potentially shortened the response time. The foundation emphasized that these programs do not transfer the underlying responsibility away from the protocols themselves.

Solana already offers several free security tools for builders, including Hypernative for threat detection, Range Security for real-time monitoring, and Neodyme's Riverguard for attack simulation.