Drift Protocol Suffers $285 Million Exploit After Admin Key Compromise and Oracle Manipulation

An attacker drained $285 million from Solana’s largest perpetual futures exchange using a fabricated token, manipulated oracles, and a compromised admin key.

An attacker drained $285 million from Drift Protocol on Tuesday, executing the largest decentralized finance exploit of 2026. The Solana-based perpetual futures exchange, which held over $550 million in total value locked at its peak, saw its TVL collapse to roughly $24 million in a matter of hours. The DRIFT token fell more than 20% in the immediate aftermath.

The exploit combined three attack vectors. The attacker first created a fake token called CarbonVote Token, minted 750 million units, and seeded a liquidity pool on Raydium with just $500. Wash trading inflated the token’s apparent price until on-chain oracles began reporting it as legitimate. The attacker then used a compromised admin key to list CVT as a valid collateral market on Drift and raised withdrawal limits to extreme levels, unlocking the vaults.

This story is an excerpt from the Unchained Daily newsletter.

Thank you for subscribing

‘;
}
// Check if event.data indicates form submission
}
});
]]>

The stolen assets included $51.6 million in USDC, 125,000 wSOL worth approximately $10.5 million, and 164,000 cbBTC valued at roughly $11.3 million, along with JLP liquidity provider tokens. The attacker consolidated the funds and bridged a significant portion from Solana to Ethereum using Circle’s Cross-Chain Transfer Protocol. On Ethereum, the attacker acquired at least 38,820 ETH, worth approximately $82.7 million, while additional funds were routed through HyperLiquid and Binance.

Drift confirmed the incident in a post on X, stating it was “observing unusual activity” and urged users to halt deposits. The protocol, founded by Cindy Leow and Josh Chand, had raised over $52 million in venture funding from investors including Multicoin Capital, Polychain Capital, and Jump Capital.

The breach ranks as the second-largest exploit in Solana’s history and adds to a growing tally of DeFi security failures in 2026. Onchain investigators are now tracking the movement of funds across multiple chains.