{
 "tag": "laundering",
 "name": "Laundering",
 "group": "Other",
 "incidents": [
  {
   "slug": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "title": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "json": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "ai": {
    "role": "agent-attack",
    "note": "TRM Labs investigator Nick Carlsen, a former FBI analyst, assessed it highly likely that the attackers used AI to pick targets and design the exploit, as The Next Web reported citing Bloomberg; this is an expert assessment, not confirmed."
   },
   "chains": [
    "solana"
   ],
   "method": "durable-nonce",
   "product": "Drift Protocol (Security Council multisig)",
   "tags": [
    "solana",
    "durable-nonce",
    "drift",
    "multisig",
    "security-council",
    "social-engineering",
    "admin-takeover",
    "cctp",
    "wormhole",
    "admin-key",
    "dprk",
    "tornado-cash",
    "laundering",
    "ai"
   ],
   "amountUsd": 285000000,
   "victims": null,
   "startedAt": "2026-04-01",
   "closedAt": "2026-04-01",
   "updatedAt": "2026-10-22T21:53:35.016Z",
   "summary": "On Apr 1, 2026, an attacker took admin control of the Solana perps exchange Drift and drained its vaults of at least $270 million; SlowMist lists $285 million. Weeks earlier, Security Council signers had been led into 'unauthorized or misrepresented' approvals. Because those transactions used durable nonces, they stayed valid until the attacker chose to submit them. The funds were bridged to Ethereum, including more than $230 million in USDC via Circle's CCTP. No code bug was needed. The lesson for teams is that any durable-nonce signing request is high risk."
  }
 ],
 "changes": [
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-10-21",
   "title": "Another 18,800 ETH (about $46M) went to Tornado Cash, a two-day total of 44,510 ETH (about $109M); about 56,569 ETH stayed in exploiter-labelled wallets per Arkham.",
   "sourceUrl": "https://cointelegraph.com/news/drift-exploiter-moves-109m-eth-tornado-cash-2-days",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-10-20",
   "title": "The Drift exploiter sent about $61M in ETH to Tornado Cash.",
   "sourceUrl": "https://cointelegraph.com/news/drift-exploiter-moves-109m-eth-tornado-cash-2-days",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-04-03",
   "title": "SecurityWeek reported Elliptic's $286M estimate and a likely North Korean link; about $225M had been swapped to Ethereum.",
   "sourceUrl": "https://www.securityweek.com/north-korean-hackers-drain-285-million-from-drift-in-10-seconds/",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-04-01",
   "title": "About a minute after a legitimate insurance-fund test withdrawal, the attacker submitted two pre-signed transactions, took admin control and drained the vaults.",
   "sourceUrl": "https://www.coindesk.com/tech/2026/04/02/how-a-solana-feature-designed-for-convenience-let-an-attacker-drain-usd270-million-from-drift",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-04-01",
   "title": "Attackers executed pre-signed durable-nonce transactions to take Drift's admin key, created a fake CVT collateral market, raised the circuit breaker and drained six assets in about 10 seconds.",
   "sourceUrl": "https://www.securityweek.com/north-korean-hackers-drain-285-million-from-drift-in-10-seconds/",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-03-30",
   "title": "A new durable nonce account tied to a member of the updated multisig appeared.",
   "sourceUrl": "https://www.coindesk.com/tech/2026/04/02/how-a-solana-feature-designed-for-convenience-let-an-attacker-drain-usd270-million-from-drift",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-03-27",
   "title": "Drift executed a planned Security Council migration to replace a member.",
   "sourceUrl": "https://www.coindesk.com/tech/2026/04/02/how-a-solana-feature-designed-for-convenience-let-an-attacker-drain-usd270-million-from-drift",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-03-23",
   "title": "Four durable nonce accounts were created, two tied to Security Council members and two controlled by the attacker.",
   "sourceUrl": "https://www.coindesk.com/tech/2026/04/02/how-a-solana-feature-designed-for-convenience-let-an-attacker-drain-usd270-million-from-drift",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  }
 ]
}