The Solana Foundation has announced a range of security measures, just days after the decentralized finance platform Drift Protocol suffered a significant $270 million exploit at the hands of a North Korean state-affiliated group. This attack was the culmination of a six-month social engineering campaign. At the forefront of these initiatives is Stride, a structured evaluation program led by Asymmetric Research.
Stride will assess Solana DeFi protocols against eight key security pillars and publicly disclose its findings. Additionally, the Solana Foundation has introduced the Solana Incident Response Network (SIRN), a membership-based group comprising security firms and researchers focused on providing real-time crisis response. While these initiatives address some of the vulnerabilities exposed by the Drift exploit, they do not directly tackle the human element that led to the loss. The Drift smart contracts were not compromised, and the code had passed audits.
The vulnerability stemmed from the attackers spending six months building relationships with Drift contributors and then compromising their devices through a malicious code repository and a fake TestFlight app. Under the Stride program, protocols with more than $10 million in total value locked (TVL) that pass the evaluation will be eligible for ongoing operational security and active threat monitoring, funded by Solana Foundation grants. The level of coverage will be tailored to each protocol's specific risk profile.
For larger protocols with over $100 million in TVL, the foundation will also fund formal verification. This mathematical method checks every possible execution path in a smart contract to ensure correctness. The founding members of SIRN include Asymmetric Research, OtterSec, Neodyme, Squads, and ZeroShadow. While the network is available to all Solana protocols, priority will be given based on TVL.
It's worth noting that Stride's formal verification would not have prevented the North Korean attack, which utilized compromised devices to obtain multisig approvals. These approvals were then locked into durable nonce transactions and executed weeks later. Similarly, 24/7 monitoring of on-chain activity would not have detected the attack, as the transactions were valid by design and indistinguishable from legitimate administrative actions until they were used to drain the vaults.
The attack exploited the gap between on-chain correctness and off-chain human trust, a gap that no smart contract audit or monitoring tool is designed to cover. However, SIRN could have potentially aided in the response to the attack. On-chain security expert ZachXBT criticized stablecoin issuer Circle Internet (CRCL) for not freezing over $230 million of its stolen dollar-pegged USDC during the six-hour window following the attack. A dedicated incident response network with established relationships to bridge operators, exchanges, and stablecoin issuers might have shortened the response time.
Whether this would have been sufficient to prevent the Wormhole bridging and obfuscation through Tornado Cash remains an open question. The Solana Foundation emphasized that these programs do not transfer the underlying responsibility away from the protocols themselves. This statement takes on a different significance in light of Drift's postmortem, which revealed that individual contributor devices were the entry point for a nation-state attack. Solana already offers several free security tools for builders, including Hypernative for threat detection, Range Security for real-time monitoring, and Neodyme's Riverguard for attack simulation.