The Solana Foundation has unveiled a range of security measures, just days after the decentralized finance platform Drift Protocol was hacked for $270 million by a North Korean state-affiliated group, following a six-month social engineering campaign. At the heart of the initiative is Stride, a structured evaluation program led by Asymmetric Research that assesses Solana DeFi protocols against eight security pillars and publishes the findings publicly. Additionally, the Solana Incident Response Network (SIRN) has been introduced, a membership-based group of security firms and researchers focused on real-time crisis response.
While these initiatives address some of the issues exposed by the Drift hack, they do not address the root cause of the loss. The Drift smart contracts were not compromised, and the code had passed audits. The vulnerability was human in nature, with the attackers spending six months building relationships with Drift contributors and compromising their devices through a malicious code repository and a fake TestFlight app.
Under Stride, protocols with over $10 million in total value locked (TVL) that pass the evaluation will receive ongoing operational security and active threat monitoring funded by Solana Foundation grants, with coverage tailored to each protocol's risk profile. For protocols with over $100 million in TVL, the foundation will also fund formal verification, a mathematical method that checks every possible execution path in a smart contract to guarantee correctness.
The network is available to all Solana protocols, but priority is given to those with higher TVL. Founding members of the network include OtterSec, Neodyme, Squads, and ZeroShadow. Although Stride's formal verification would not have caught the North Korean attack, which used compromised devices to obtain multisig approvals that were then locked into durable nonce transactions and executed weeks later, SIRN could have potentially assisted with the response.
Onchain security expert ZachXBT criticized stablecoin issuer Circle Internet (CRCL) for failing to freeze over $230 million of its stolen dollar-pegged USDC during a six-hour window after the attack began. A dedicated incident response network with established relationships to bridge operators, exchanges, and stablecoin issuers might have shortened the response time. The foundation emphasized that the programs do not transfer the underlying responsibility away from the protocols themselves, a point that takes on a different meaning after Drift's postmortem revealed that individual contributor devices were the entry point for a nation-state attack.
Solana already offers several free security tools for builders, including Hypernative for threat detection, Range Security for real-time monitoring, and Neodyme's Riverguard for attack simulation.