OAK — OnChain Attack Knowledge

Worked example · 2026-04

Drift Protocol durable-nonce admin-takeover and fictitious-collateral drain — Solana — 2026-04-01

Loss
approximately $285M extracted from Drift Protocol on April 1, 2026, in a single-block-sequence attack window. Drift is a Solana-native perpetual-futures and lending DEX; the drained value represented over 50% of protocol TVL at the time of the incident and ranks as the largest DeFi exploit of 2026 to date and the second-largest exploit in Solana ecosystem history behind only the Wormhole bridge incident (~$326M, February 2022; see examples/2022-02-wormhole.md). The contagion footprint extended to ≥20 downstream protocols whose vault-strategy integrations included Drift collateral exposure or whose JLP / DLP-style products touched the affected markets.
Recovery
none publicly confirmed at v0.1 cutoff (2026-04-30). Mandiant has been engaged for forensic investigation; on-chain proceeds were swapped through a Solana-native DEX aggregator into USDC, then bridged to Ethereum and converted to ETH; subsequent routing fingerprint matches DPRK / OAK-G01 standard post-extraction laundering rails.
OAK-Gnn
OAK-G01 Lazarus Group / DPRK-attributed.
Attribution
inferred-strong at the cohort layer (DPRK / OAK-G01); per-individual operator names not public at v0.1 cutoff. Drift Foundation's own April 2026 post-mortem attributes the operation to UNC4736 (a North Korean state-affiliated group also tracked as AppleJeus / Citrine Sleet). Mandiant engaged for forensic investigation. Elliptic's incident analysis cites the Tornado Cash origin of operator funding, the Pyongyang-time-zone deployment signature on the CVT mint and oracle program, the social-engineering focus consistent with the broader DPRK Lazarus-cohort tradecraft, and the post-hack laundering speed (~hours from drain to first cross-chain hop). TRM Labs and Chainalysis published independent attribution analyses converging on the same cohort fingerprint. The vector likely chained with a known VSCode / Cursor code-editor vulnerability active December 2025 - February 2026 that allowed silent arbitrary code execution against developer machines, providing the initial off-chain compromise leverage; this is consistent with the broader 2024-2026 DPRK developer-tooling-compromise pattern (the same surface implicated in Radiant Capital October 2024 and WazirX July 2024 attribution).
Key teaching point
Solana's durable_nonce feature is a callback-style attack surface against signing workflows, structurally distinct from EVM permit / EIP-7702 surfaces. Standard Solana transactions expire after ~90 seconds (one slot ≈ 400ms × ~150-block recent-blockhash window). The durable_nonce mechanic, designed to support multisig coordination and offline-signing workflows where signers may take days to coordinate, decouples the signing event from the execution event by replacing the recent-blockhash check with a nonce-account-derived value that remains valid until the nonce is advanced. The Drift attack is the first publicly-disclosed industrial-scale exploitation of this decoupling against a multisig signing workflow: legitimately-signed-but-deferred transactions were triggered at attacker-chosen timing to transfer admin authority, with the signers' visibility of the signing event temporally separated from the execution event by months. Defenders running multisig signing workflows on Solana must treat durable_nonce-bearing transactions as a first-class surface that requires post-signing monitoring (which transactions have been signed but not yet broadcast) in addition to the standard pre-signing simulation surface. The class generalises beyond Drift: any Solana protocol whose admin authority lives behind a multisig that uses durable nonces for coordination is exposed to the same surface.

OAK Techniques observed:

  • OAK-T11.001 (Third-Party Signing-Vendor Compromise — broad construction) and OAK-T11.003 (Multisig Contract Manipulation) as the administrative-control failure surface. Drift's Security Council multisig was the on-chain authority over protocol parameters; the attackers obtained admin control by tricking the legitimate Security Council members into pre-signing dormant transactions that, when triggered, transferred admin authority to attacker-controlled addresses. Distinct from a stolen-private-key compromise: the council members signed legitimately under their belief that they were signing routine maintenance transactions, but the durable-nonce mechanic decoupled the signing event from the execution event, allowing weeks-or-months-old signatures to fire at attacker-chosen timing.
  • OAK-T9.001 (Oracle Price Manipulation) as the valuation failure surface, with a Solana-specific fictitious-collateral construction. The attacker pre-deployed CVT (CarbonVote Token) on March 12, 2026 with a 750M total supply, seeded a small Raydium liquidity pool with a few thousand dollars, wash-traded CVT to anchor its price at ~$1, and deployed an attacker-controlled price-oracle program that fed the fictitious price into Drift's collateral-valuation logic after admin takeover changed the protocol's whitelist to accept CVT.
  • OAK-T9.004 (Access Control Misconfiguration — broad construction) as the linking primitive. Once admin authority was transferred, the attacker-side admin role had standing authority to change collateral whitelists, debt limits, and oracle assignments without timelock or multi-stage governance; the access-control surface was post-takeover legitimate-by-protocol-rules, which is what made the on-chain extraction sequence look like "normal admin parameter changes" to Drift's monitoring stack until the fund movements completed.
  • OAK-T8.002 (Cross-Chain Operator Continuity) and OAK-G01 (DPRK / TraderTraitor cluster) attribution at the operator-cluster layer. The social-engineering campaign began Fall 2025, presenting attackers as a quantitative trading firm to build trust with Drift contributors over six months; Mandiant's attribution and Elliptic / TRM Labs / Chainalysis post-mortem coverage all converge on DPRK-linked actors (UNC4736 / AppleJeus / Citrine Sleet cluster). The vector overlaps Wormhole 2022, Ronin 2022, Atomic Wallet 2023, Radiant Capital 2024, WazirX 2024, DMM Bitcoin 2024, and Bybit 2025 in the same long-cycle social-engineering / signing-surface-compromise fingerprint.

Summary

On April 1, 2026, Solana-based perpetual-futures and lending DEX Drift Protocol announced it was investigating suspicious activity and asked users to halt deposits. Within hours, the platform confirmed that approximately $285M had been drained from its lending markets via a coordinated administrative-takeover attack. The drained funds were swapped through Solana-native DEX aggregators into USDC and bridged to Ethereum.

The attack chain — disclosed in Drift Foundation's post-mortem and corroborated by independent forensic write-ups from Chainalysis, Elliptic, TRM Labs, Mandiant (engaged by Drift), and Crowell & Moring's legal-implications analysis — proceeded in five distinct phases:

  1. Months-long social-engineering pretexting (Fall 2025 → March 2026). DPRK-linked operators (attributed to UNC4736 / AppleJeus / Citrine Sleet) cultivated relationships with Drift contributors by presenting themselves as a legitimate quantitative trading firm. The cohort included in-person interactions with Drift personnel, building institutional trust that informed subsequent signing-surface coercion.

  2. Off-chain initial-access compromise (December 2025 - February 2026). The attackers likely exploited a known vulnerability in VSCode and Cursor code editors active in this window that allowed silent arbitrary code execution against developer machines without user prompts. This provided initial access to one or more Drift contributors' development environments and the surrounding signing-surface infrastructure. (This window overlaps with the broader 2024-2026 DPRK developer-tooling-compromise cohort implicated in adjacent cases.)

  3. CVT fictitious-asset deployment (March 12, 2026). The attackers deployed CVT (CarbonVote Token) on Solana with a 750M total supply, seeded a small Raydium liquidity pool with ~$10K of liquidity, and wash-traded CVT to anchor its quoted price at approximately $1. They also deployed an attacker-controlled price-oracle program, structured to feed the fictitious $1 CVT price into any consuming protocol that whitelisted it as a collateral oracle.

  4. Durable-nonce-mediated admin takeover (March 2026 - April 1, 2026). Drift's Security Council members were tricked into pre-signing dormant transactions presented as routine maintenance / parameter updates. The transactions used Solana's durable_nonce mechanic, which decouples signing from execution by replacing the standard recent-blockhash expiration with a nonce-account-derived value that remains valid until the nonce is advanced. When triggered at attacker-chosen timing on April 1, 2026, the signed-but-deferred transactions transferred Drift's protocol admin authority to attacker-controlled multisig members.

  5. Whitelist-CVT / drain extraction (April 1, 2026). With admin authority obtained, the attackers used the standing protocol-parameter authority to whitelist CVT as collateral, assign the attacker-controlled oracle as CVT's price source, and set CVT borrowing limits to effectively unlimited. They then deposited 500M CVT (worth ~$0 in real terms but valued at ~$500M by the protocol via the attacker's oracle), borrowed against the inflated valuation, and withdrew approximately $285M in real assets — primarily USDC, SOL, ETH, and other deep-liquidity tokens — from Drift's lending markets.

After the drain, the attacker swapped the stolen tokens through a Solana-native DEX aggregator into USDC, bridged to Ethereum, and converted to ETH. Mandiant was engaged for forensic investigation; Elliptic / TRM Labs / Chainalysis published attribution analyses converging on DPRK / OAK-G01.

The contagion footprint reached at least 20 downstream protocols whose vault-strategy integrations included exposure to Drift's lending markets or whose JLP / DLP-style yield products touched the affected collateral types. The Solana Foundation announced a security overhaul in the days following the incident.

Why this is structurally significant

The Drift attack is structurally distinct from prior Solana DeFi exploits in three ways:

  1. The durable_nonce exploitation is genuinely novel. Solana's durable_nonce is a runtime feature designed for offline-signing and multisig-coordination workflows. The Drift case is the first publicly-disclosed industrial-scale exploitation of the feature as an attack surface. The structural shape — legitimately-signed-but-deferred-execution transactions triggered at attacker-chosen timing — has no clean cross-chain analogue: EVM transactions do not have a comparable durable-validity primitive (nonces are sequential, gas-price-bound, and chain-blocktime-bound). The closest cross-chain analogue is the EIP-7702 set-code-transaction-type surface (covered in examples/2025-05-eip7702-crimeenjoyor-delegation-phishing-cohort.md), which is also a callback-style EOA-execution-context-replacement primitive but operates at a different semantic layer.

  2. The fictitious-collateral primitive is Solana-DeFi-specific in operational shape. EVM analogues exist (the canonical case is the 2022-2023 "fake bridge token" cohort), but the Drift CVT-with-attacker-controlled-oracle pattern leverages Solana's program-deployment-cost economics and Raydium's permissionless-pool primitive to create a low-cost-fictitious-asset substrate. The CVT mint cost ~$1, the oracle program cost a few SOL, the wash-trading anchoring cost ~$10K — for a sub-$15K precondition cost the attacker created a $500M valuation surface for the post-takeover drain phase.

  3. The cross-chain laundering signature is the canonical OAK-G01 fingerprint at speed. The drain-to-first-Ethereum-hop window was hours, not days. This is the operational signature of a pre-staged laundering pipeline, not an opportunistic post-hoc routing decision. The DPRK-cohort's matured tradecraft on Solana-to-Ethereum bridge laundering (post-Wormhole-2022, post-Ronin-2022, post-Atomic-Wallet-2023, post-WazirX-2024, post-DMM-Bitcoin-2024, post-Bybit-2025) is now operationally tighter than the on-chain incident-response surface for a 6-hour Sunday-afternoon attack window.

  4. The contagion footprint demonstrates that Solana DeFi is now sufficiently interconnected to produce cascade effects. ≥20 downstream protocols had Drift exposure. This is structurally similar to the 2022 Three-Arrows / Celsius / Voyager interconnectedness that produced the broader 2022 contagion event, scaled down by a factor and operating at the protocol-strategy-vault layer rather than the centralised-borrowing layer. The Solana Foundation's response — a security overhaul announcement within days — signals that the foundation now treats DeFi-protocol-level exploits as ecosystem-level events, comparable to how Ethereum responded to the 2016 DAO incident.

Timeline (UTC)

When Event OAK ref
Pre-2025-Q3 Drift Protocol operates standard Solana DEX architecture; Security Council multisig with durable-nonce-based coordination workflow; Drift personnel and contributors operate development environments using mainstream IDEs (VSCode / Cursor) (genesis surface)
Fall 2025 DPRK-linked operators (UNC4736 / AppleJeus / Citrine Sleet) initiate social-engineering campaign against Drift contributors, presenting as a quantitative trading firm; relationship-building proceeds over six months OAK-G01 standard pretexting surface
2025-12 to 2026-02 VSCode / Cursor code-editor vulnerability allowing silent arbitrary code execution active; likely exploited as initial-access vector against Drift contributors' development environments (off-chain initial access)
2026-03-12 CVT (CarbonVote Token) deployed on Solana with 750M total supply; small Raydium pool seeded; wash-trading establishes ~$1 quoted price; attacker-controlled oracle program deployed T9.001 fictitious-collateral pre-staging
2026-03-* (weeks before drain) Drift Security Council members tricked into pre-signing dormant transactions presented as routine maintenance, using durable-nonce mechanic; signed transactions held in attacker-controlled execution queue T11.003 + durable-nonce surface
2026-04-01 Attacker triggers signed-but-deferred admin-transfer transactions; Drift admin authority transferred to attacker-controlled addresses; CVT whitelisted as collateral with attacker-controlled oracle and effectively-unlimited borrowing limits T11.003 admin takeover
2026-04-01 Attacker deposits 500M CVT, borrows against inflated valuation, drains ~$285M in real assets (USDC, SOL, ETH, others) T9.001 + T9.004 extraction
2026-04-01 Drift announces investigating suspicious activity; asks users to halt deposits (operator detection)
2026-04-01 Bloomberg, CoinDesk, The Block, DL News publish initial coverage; ~$270-285M loss confirmed (forensic surface — initial)
2026-04-01 → hours Attacker swaps stolen tokens through Solana-native DEX aggregator into USDC, bridges to Ethereum, converts to ETH T7.003 cross-chain bridge laundering
2026-04-02 The Hacker News, Crowell & Moring, Chainalysis publish first-cycle technical and legal analyses (forensic + regulatory surface)
2026-04-03 onward Mandiant engaged for forensic investigation; Elliptic / TRM Labs / Chainalysis attribute to DPRK / OAK-G01 cohort Attribution → inferred-strong
2026-04-07 Solana Foundation announces ecosystem-wide security overhaul in response to Drift incident (defender response — ecosystem level)
Continuing Recovery actions ongoing; ~20 downstream protocols disclose Drift-exposure-related disruptions or losses; criminal proceedings not public at v0.1 cutoff (continuing surface)

What defenders observed

  • Pre-event (off-chain compromise layer): the social-engineering campaign was the load-bearing initial-access surface. Drift's contributors had no organisational visibility of the months-long pretexting; the fake-quantitative-trading-firm narrative is consistent with the broader 2024-2026 DPRK pattern of long-cycle social-engineering against high-trust developer roles. Defender lesson: organisational threat modelling for Solana DeFi protocols should now treat sustained relationship-building from external "partner" entities as a standard precondition for high-impact technical compromise, not as an unusual edge case.
  • Pre-event (signing-surface layer): the durable-nonce mechanic was the load-bearing technical primitive. Drift's Security Council signing workflow used durable_nonce for offline-signing coordination, which is a legitimate operational pattern. The vulnerability was in the visibility surface — once a transaction was signed under a durable nonce, its execution timing was attacker-controlled, and Drift's monitoring stack had no clean signal for "signed transactions awaiting execution that have not yet been broadcast." Defender lesson: any Solana multisig that uses durable nonces for coordination needs a post-signing monitoring layer in addition to standard pre-signing simulation. The signing-execution decoupling is structurally similar to the EIP-7702 delegation pattern but operates at the multisig-coordination layer rather than the EOA-execution layer.
  • At-event (admin-takeover layer): the admin-authority transfer was an on-chain event observable in real time, but it executed as a legitimately-signed transaction from Drift's existing Security Council members' keys. Drift's monitoring stack had no signal to distinguish "admin transfer signed three weeks ago for operational reasons" from "admin transfer signed three weeks ago under social-engineering coercion as part of an attack." Defender lesson: monitoring-layer distinctions between legitimate-by-protocol-rules and legitimate-by-defender-intent require off-chain operational context that on-chain monitoring alone cannot reconstruct.
  • At-event (extraction layer): the CVT collateral whitelist + oracle assignment + parameter changes + deposit + borrow + withdraw sequence executed within a single Solana block-cluster window. Solana's high-throughput execution amplifies the time-to-detection requirement (compared to EVM where the same sequence would span more wall-clock-time). Drift's response — pause deposits, announce investigation — landed within hours; the bulk of the extraction was complete before the pause. Defender lesson: Solana DeFi protocols need automated circuit breakers tied to extraction-magnitude signals, not human-operator pause loops, because human response time is structurally too slow for Solana's execution speed.
  • Post-event (laundering surface): the drain-to-first-Ethereum-hop latency was hours, demonstrating pre-staged laundering. The DPRK-cohort's Solana-to-Ethereum bridge laundering substrate is now operationally mature; recovery via on-chain freezing or operator-side bridge cooperation is structurally infeasible at the speed at which the laundering pipeline operates. Defender lesson: post-incident recovery via on-chain interventions is no longer a realistic primary recovery surface for DPRK-class operators against Solana DeFi; recovery now depends on off-chain attribution (Mandiant), regulatory action, and long-cycle cross-chain forensic work.

What this example tells contributors writing future Technique pages

  • Solana's durable_nonce is a first-class signing-surface attack class. Future T11.003 examples involving Solana multisigs should record whether the workflow uses durable nonces and, if so, treat the signing-execution decoupling as a discrete sub-surface. The Drift case is the canonical 2026 worked example for this sub-pattern.
  • DPRK / OAK-G01 long-cycle social-engineering against DeFi protocols is the dominant 2025-2026 high-impact attribution class on Solana. The Drift case extends the cluster from CEX-vendor compromises (Bybit Feb 2025, DMM Bitcoin May 2024, WazirX Jul 2024, Phemex Jan 2025, Indodax Sep 2024) into DeFi-protocol-admin compromises. Future OAK-G01 attribution analysis should treat DeFi protocols as in-scope targets, not just CEXs.
  • Fictitious-collateral with attacker-controlled oracle is a recurring 2024-2026 sub-pattern within T9.001. The Drift CVT pattern is the highest-magnitude 2026 case; smaller-scale instances recur across the EVM and Solana DeFi corpus. Future T9.001 examples should preserve the fictitious-collateral sub-pattern as a discrete sub-class within the broader oracle-manipulation class.
  • The off-chain developer-tooling-compromise vector (VSCode / Cursor December 2025 - February 2026 window) is part of the broader DPRK initial-access surface. Future OAK-G01 analysis should integrate the developer-tooling vector into the standard initial-access checklist alongside the established phishing / fake-recruiter / supply-chain-package vectors.
  • Solana ecosystem-level response — Solana Foundation security overhaul — is a real institutional-trust signal. Future Solana DeFi worked examples should document the foundation-level response as a first-class observable, comparable to how Ethereum-side analysis treats Vitalik / EF response.

Public references

Discussion

Drift is OAK's canonical 2026 Solana DeFi worked example for the durable-nonce signing-decoupling + fictitious-collateral admin-takeover combined-class. The case sits at the intersection of T11.003 (multisig manipulation, with a Solana-specific sub-surface), T9.001 (oracle manipulation, with a fictitious-collateral sub-pattern), T9.004 (post-takeover access-control, where the access control is legitimate-by-protocol-rules), and OAK-G01 (DPRK long-cycle social-engineering tradecraft).

The structural distinguishing feature of the case — and the reason it warrants a standalone worked example rather than being subsumed into the broader OAK-G01 cohort — is the durable-nonce signing-decoupling primitive. This is a Solana-runtime-specific surface that does not appear in the EVM-side OAK-G01 portfolio (Bybit, DMM Bitcoin, WazirX, Phemex, Indodax, Radiant Capital, Atomic Wallet). The case extends the OAK-G01 cohort's attack-surface footprint from the EVM vendor-signing-stack surface into the Solana protocol-multisig surface, and demonstrates that the cohort's tradecraft is now operationally adapted to non-EVM L1 specifics.

For OAK's broader cohort coverage, this case + the Loopscale RateX-pricing case (examples/2025-04-loopscale.md) + the Cetus CLMM-overflow case on Sui (examples/2025-05-cetus.md) + the Cypher sub-account-isolation case (examples/2023-08-cypher.md) + the Crema fake-tick-array case (examples/2022-07-crema-finance.md) collectively establish that non-EVM L1 DeFi failure modes have L1-specific operational properties that the OAK Technique surface must preserve. The Drift case is the highest-magnitude 2026 case in this set and the strongest evidence that the cohort matters for OAK's broader credibility on chain-coverage.

The litigation and regulatory surface is in early development at v0.1 cutoff: no US criminal charges public; Mandiant forensic investigation ongoing; Solana Foundation security overhaul announced but operational details not yet public. The case will likely produce additional documentation through 2026-2027 as the forensic and legal proceedings advance; OAK should track the case for promotion of OAK-G01 attribution-strength language and for the durable-nonce sub-surface's promotion to a dedicated Technique page if the cohort grows beyond the single Drift case.

Techniques demonstrated (5)