Drift Protocol, a decentralized exchange built on Solana, has confirmed it was the target of a roughly $280 million exploit that the platform describes as a highly sophisticated operation. The attack began on Wednesday, with the protocol announcing it was under active assault before suspending deposits and withdrawals. Drift subsequently coordinated with security firms, bridges, and exchanges as part of its initial response.
According to findings from a preliminary investigation shared on X, attackers exploited Solana’s durable nonces — a mechanism that allows transactions to be pre-signed for future execution — to gain unauthorized administrative access. By using durable nonce-based, pre-signed transactions, the attackers were able to execute malicious actions rapidly once submitted. Drift described the operation as highly coordinated, distinguishing it from a conventional smart contract failure.
Solana’s durable nonce feature is designed to let users bypass certain transaction expiration windows, enabling offline signing and complex multisig workflows. While the feature has not previously been widely linked to major exploits on its own, developers have noted that mechanisms allowing delayed execution can introduce complexity and risk when misused or combined with other vulnerabilities. The incident marks one of the more prominent cases in which a legitimate Solana transaction feature appears to have been abused at scale.
The stolen assets included Circle‘s USDC and various altcoins. Onchain data shows the exploiter converted the majority of the funds into USDC before bridging them to Ethereum. The movement of funds across chains over several hours without any freezing action drew significant attention from the broader crypto community.
Onchain investigator ZachXBT and others noted that Circle had at least six hours during which it could have frozen the funds but did not intervene. This drew comparisons to earlier incidents in which wallets were blacklisted more swiftly. The episode has reignited a recurring debate about the responsibilities of centralized stablecoin issuers during active exploits.
Some industry participants drew a distinction between Circle’s technical ability to freeze funds and any formal obligation to do so. Pseudonymous commentator Molu wrote on X that Circle could freeze the funds but is not required to, adding that proposed regulatory frameworks such as the GENIUS Act could alter that dynamic by mandating intervention once finalized rules are in place. The comment highlighted the regulatory uncertainty that currently surrounds stablecoin issuers’ roles in theft scenarios.
This is not the first time Circle’s response to a major hack has come under scrutiny. ZachXBT previously questioned the company’s handling of USDC connected to a Bybit-related hack in late February. Circle CEO Jeremy Allaire responded at the time by stating that the company acts on law enforcement requests before moving to freeze funds. The Drift incident adds further pressure to that position as the industry continues to debate the appropriate role of centralized platforms during decentralized protocol attacks.
Originally reported by CoinTelegraph.
