Attack Vector

The attacker chained four distinct capabilities rather than relying on a single primitive:

Security Council multisig compromise. One or more signer keys were obtained (phishing / infra compromise — the exact vector remains debated). This alone did not drain funds, but granted privileged write access to governance-gated configuration.

Fake token insertion via oracle path. The attacker registered a new "market" pointing at a synthetic asset whose price feed they controlled. The oracle path was permissioned but not sanity-checked against spot liquidity.

Durable nonce pre-signing. Rather than submitting the final drain transaction live, the attacker pre-built and pre-signed the extraction using Solana durable nonces. This decoupled signing time from landing time — the malicious tx could sit dormant and land atomically the moment the oracle was manipulated.

Atomic manipulation → drain → bridge. In a tight block window: push oracle price, trigger liquidation-equivalent path against the fake market, sweep protocol-held collateral, immediately bridge out via Wormhole / de.fi routes to Ethereum, then tumble via cross-chain hop patterns.

Prerequisites

Access to at least one Security Council signer key (obtained via social/infra channel, not on-chain)
Knowledge of Drift's market-registration flow and the absence of a TWAP sanity bound on newly-listed assets
Pre-funded attacker EOA on destination chain to receive bridged assets without KYC friction
Operational capability to construct and sign Solana durable-nonce transactions (non-trivial — most tooling assumes live signing)
Timing: execution during low-activity window to reduce probability of searcher front-run or social flag

On-Chain Evidence

Label	Value
Primary exploit tx	_(Solana sig — fill from research)_
Attacker EOA (SOL)	_(fill)_
Bridge-out leg	Wormhole transfer to 0x... on Ethereum
Governance tx (market registration)	_(sig — the "pre-crime" transaction)_
Block / slot	~slot 3.0×10^8 range

Evidence fields are placeholders. Primary sources: Helius tx explorer, Solscan, protocol post-mortem.

Mitigation

Protocol-level:

TWAP or independent spot sanity check on all oracle reads, especially for newly-registered markets (≥ N-block observation window before activation)
Timelock between market registration and market becoming drainable
Signer-set hygiene: hardware-only signing, geographic signer distribution, rotation policy

Ecosystem-level:

Bridges should enforce circuit breakers on single-address outflows exceeding protocol TVL percentiles
Searcher/MEV infra should surface "new market + immediate large trade from privileged path" as a flag

Detection-side (what was missed):

The governance tx registering the fake market landed hours before the drain. A monitoring layer watching the Security Council multisig for any state-changing tx — and alerting humans — would have caught it in a window where rollback was possible.

Novel Detection Heuristic — Pre-Commit Nonce Heat Map

Signal: For protocols on chains supporting durable nonces (Solana) or flashbots-style bundles (Ethereum), track the gap between nonce creation and nonce consumption per address, weighted by account value-at-risk.

How it works:

Watch durable nonce account creations from any address that has ever interacted with privileged roles (council members, admin proxies, oracle updaters).
When a durable nonce has been idle for > 1 hour AND the owning address has privileged write access, raise monitoring state from green → yellow.
Cross-correlate with governance-surface events (market registrations, param changes, oracle feed registrations) in the same window.
If a privileged-adjacent address has (a) an aging durable nonce plus (b) recent governance surface touching oracle-priced markets → CRITICAL flag.

Why it would have caught Drift:

The attacker had to pre-sign before manipulating oracle state, because post-manipulation the window was measured in slots. That pre-signing created a durable-nonce artifact before the on-chain evidence of malice. A heuristic watching the privileged-address pre-commitment surface catches intent in the window between preparation and execution — exactly the window defenders want.

Failure modes:

Legitimate ops use durable nonces too (scheduled upgrades) — requires allowlist maintenance
Attacker can use a fresh, unaffiliated nonce account if they accept the risk of live signing
Doesn't generalize to chains without first-class nonce primitives

Notes & Open Questions

Was the signer compromise human-factor or infra? Public post-mortem was vague.
Did the attacker run a test drain on a smaller market first? Would show in pre-event anomaly scans.
Follow-up: build a Solana RPC watcher PoC for the heuristic above. Target output: a stream of "privileged pre-commitment" events with risk score. Portfolio piece on its own.

Last reviewed: 2026-04-17