DriftProtocol hack update

The team confirms this was a 6-month coordinated social engineering campaign, not a smart contract exploit—attackers posed as a trading firm, built trust across IRL meetings + onchain activity, then compromised contributors via malicious repos & fake wallet apps.

Drift has fully frozen the protocol, removed compromised wallets from multisig, and is working with security firms & law enforcement while publicly sharing details to help the ecosystem learn—urging all Solana teams to treat every multisig device as a target and audit access immediately.

The attack is linked with medium-high confidence to Lazarus Group–style operations, reinforcing that human-layer security is now DeFi’s biggest risk vector. ⚠️

👉 Anatoly Yakovenko noted Drift handled loss socialization fairly, suggesting a path forward: rebuild with a lean core team + compensate users via structured recovery (e.g. airdrops).

⚠️ Takeaway: this isn’t just a Drift incident—it’s a wake-up call for all Solana projects to harden opsec, isolate signer devices, and rethink trust in offchain interactions.