Cowrie Research

drift-protocol-security-council-durable-nonce-admin-takeover-cvt-counterfeit-collateral-drain-2026-04-01

15 min read

Drift Protocol Security Council Durable-Nonce Admin Takeover / CVT Counterfeit-Collateral Drain (2026-04-01)

  • Name: Drift Protocol Security Council durable-nonce admin takeover / CVT counterfeit-collateral drain
  • Date: 2026-04-01
  • Protocol: Drift Protocol
  • Chain: Solana, with cashout bridged to Ethereum
  • Category: stored-privileged-approval persistence / blind-sign payload substitution / signer-quorum compromise / counterfeit collateral admission / oracle manipulation
  • Loss: about $285.3M
  • Summary: On 2026-04-01, attackers used months of social engineering, compromised contributor devices, and Solana durable-nonce transactions to collect valid approvals from 2-of-5 Drift Security Council signers before execution day. When the stored Squads transactions were finally broadcast, they transferred Drift admin authority to attacker-controlled address H7PiGqqUaanBovwKgEtreJbKmQe6dbq6VTrw6guy7ZgL without needing to break any onchain signature checks. With that authority, the attacker initialized a new spot market for attacker-created token CVT, pointed it at an attacker-controlled oracle, gave it permissive collateral parameters, and raised withdraw_guard_threshold limits on major real-asset markets to 500,000,000,000,000. An attacker account then deposited 500,000,000 CVT and used the fake collateral value to withdraw real assets — especially JLP, USDC, cbBTC, USDT, USDS, WETH, dSOL, and JitoSOL — in a rapid drain worth about $285.3M. The decisive invariant failure was not a bug in Drift’s runtime math; it was that valid admin signatures plus zero-delay authority were enough to rewrite what the protocol considered acceptable collateral and withdrawable value.
  • Trigger / entry point:
    • Drift’s investigation and later reporting describe a multi-month social-engineering operation in which attackers posed as a legitimate quant / integration counterpart, built real relationships with contributors, and compromised at least two contributor devices through malicious tooling and app-delivery vectors.
    • On 2026-03-23, four durable nonce accounts were created, including two associated with Drift Security Council members and two attacker-controlled accounts. Drift later published those nonce accounts in its public timeline.
    • Drift then migrated its Security Council to a 2-of-5 configuration with zero timelock around 2026-03-26 / 2026-03-27. By 2026-03-30, the attacker had already re-established durable-nonce coverage against the updated signer set.
    • Separately, on 2026-03-12 the attacker created CarbonVote Token (CVT), minted 750,000,000 units, seeded shallow Raydium liquidity, wash-traded it around $1, and prepared an oracle path the attacker controlled.
    • When the attacker finally broadcast the pre-signed durable-nonce transactions on 2026-04-01, Drift’s admin surface accepted them as ordinary valid Security Council actions.
  • Root cause:
    • Drift concentrated high-impact powers — admin transfer, spot-market creation, oracle configuration, collateral-weight changes, and withdrawal-guard changes — behind a low-threshold 2-of-5 Security Council with zero timelock.
    • Solana durable nonces removed the usual short expiration window for mistaken signatures, so once the attacker harvested signer approvals, the malicious transactions remained executable until the chosen attack moment.
    • The signer workflow failed at intent verification: the decisive problem was not stolen seed phrases but that signers approved a different effective action than the one they believed they were authorizing.
    • After admin capture, Drift had no independent asset-admission guard that could stop a freshly created, attacker-manufactured token with fake price history from becoming live collateral.
    • Withdrawal guardrails were themselves admin-controlled, so the same compromised authority that listed fake collateral could also remove the throttles that might otherwise have slowed the drain.
  • Exploit path:
    1. Over roughly six months, attackers cultivated trust with Drift contributors through conferences, Telegram chats, product discussions, and an apparently legitimate ecosystem-vault / integration story.
    2. According to Drift’s later investigation, the attackers compromised contributor devices through at least two malware vectors, including a malicious code repository and a fake TestFlight-distributed app.
    3. On 2026-03-12, the attacker created CVT at mint address G84LEhbNMR1yYbHgHbnNYNSK8mpTKcazh5jcW5yMPQKo, minted 750,000,000 tokens, and began manufacturing fake market legitimacy with shallow liquidity and wash trading.
    4. On 2026-03-23 and again on 2026-03-30, the attacker prepared durable-nonce accounts associated with Drift Security Council signers, preserving valid signer approvals for later Squads execution even across Drift’s council migration.
    5. At about 16:05 UTC on 2026-04-01, transaction 2HvMSgDEfKhNryYZKhjowrBY55rUx5MWtcWkG9hqxZCFBaTiahPwfynP1dxBSRk9s5UTVc8LFeS4Btvkm9pc2C4H created and approved a malicious admin-transfer proposal.
    6. One second later, transaction 4BKBmAJn6TdsENij7CsVbyMVLJU1tX27nfrMM1zgKv1bs2KJy6Am2NqdA3nJm4g9C6eC64UAf5sNs974ygB9RsN1 advanced the durable nonce, approved the proposal, and executed the stored Squads flow that transferred Drift admin authority to attacker-controlled address H7PiGqqUaanBovwKgEtreJbKmQe6dbq6VTrw6guy7ZgL.
    7. With admin authority captured, transaction 4a5962Rdqd9pkXtk9DMQ9ZYhdGb2k9gPw71GvukJgELhxbCY5gm1c1hhKdwuGefyqJ3XMvihUTDNDn3qbXnst82X initialized Drift spot market 63 for CVT, configured oracle B6X3YojuJcfHnTTre68b2XxDPCVTfeA4N7ZJEpME2nFp, and raised withdrawal-guard thresholds on five major markets to 500,000,000,000,000.
    8. The attacker initialized a Drift user account in transaction 4xzb1AXSw45Q8SoPkACXFyFUwGtYWQauuDmiwEDXijYDmEfRCz9ZPXSooSy1CzMbeW66kg9uayJp3QW38YdTMFxT, then deposited 500,000,000 CVT in transaction 5V72ZK1WejP5Mh3uryEy6BZCV6ukSAnZBFSvHTqfD4NS38xKJUuh4RV5F8D4tDbgMsB2dcTJyZf7hLxH34nCRHRE.
    9. Drift now treated the attacker’s nearly worthless CVT inventory as hundreds of millions of dollars of collateral. Over about 31 withdrawals in roughly 12 minutes, the attacker drained real assets to recipient wallet HkGz4KmoZ7Zmk7HN6ndJ31UJ1qZ2qgwQxgVqQwovpZES, including about 42.72M JLP, 71.42M USDC, 164.35 cbBTC, 5.65M USDT, 5.25M USDS, 2,200.59 WETH, and large quantities of Solana LSTs and other tokens.
    10. The attacker then swapped and bridged much of the stolen inventory off Solana, with reporting noting more than 100 Circle CCTP transfers carrying roughly $232M of USDC toward Ethereum before further conversion into ETH.
  • What the attacker needed to be true:
    • Two compromised or deceived Security Council signers had to be enough to satisfy Drift’s effective authority threshold.
    • Drift had to rely on durable-nonce-compatible signing workflows without a revocation window, transaction-intent verification layer, or timelock that could catch delayed malicious execution.
    • The Security Council had to retain live power to add new collateral markets, set oracle sources, and loosen withdrawal limits without an independent quarantine or allowlist.
    • Drift’s collateral engine had to be willing to honor a fresh, attacker-created token as borrowable truth once admin parameters said it was acceptable.
    • Drift’s vaults had to hold deeper-liquidity assets than the true executable value of the posted CVT collateral.
  • Technical anatomy worth remembering:
    • Drift is a clean example of admin capture monetized through collateral admission rather than through a direct upgradeTo()-style drain. The attacker first captured authority, then used ordinary protocol features to teach Drift that fake collateral was real.
    • Durable nonces are central to the case. The important security lesson is not just blind signing is dangerous, but that on Solana a mistakenly signed durable-nonce transaction does not age out the way a recent-blockhash transaction normally would.
    • The cashout path had two layers: first admin capture, then counterfeit collateral admission. That makes Drift a useful bridge between signer-compromise incidents like Radiant / Bybit and solvency-fiction incidents where attacker-minted paper is cashed out through deeper reserve assets.
    • Raising withdraw_guard_threshold to 500,000,000,000,000 on major markets mattered as much as listing CVT. Fake collateral alone would have been less useful if the ordinary withdrawal throttles had still constrained outflows.
    • The incident also preserves a hard timing lesson: once zero-timelock admin control was transferred, the economically decisive actions — market creation, oracle substitution, collateral deposit, and reserve withdrawals — unfolded in minutes.
  • Representative transactions and addresses:
    • Drift Security Council admin-transfer proposal tx: 2HvMSgDEfKhNryYZKhjowrBY55rUx5MWtcWkG9hqxZCFBaTiahPwfynP1dxBSRk9s5UTVc8LFeS4Btvkm9pc2C4H
    • Drift Security Council admin-transfer execution tx: 4BKBmAJn6TdsENij7CsVbyMVLJU1tX27nfrMM1zgKv1bs2KJy6Am2NqdA3nJm4g9C6eC64UAf5sNs974ygB9RsN1
    • Admin setup / market-creation / withdrawal-guard tx: 4a5962Rdqd9pkXtk9DMQ9ZYhdGb2k9gPw71GvukJgELhxbCY5gm1c1hhKdwuGefyqJ3XMvihUTDNDn3qbXnst82X
    • Attacker user initialization tx: 4xzb1AXSw45Q8SoPkACXFyFUwGtYWQauuDmiwEDXijYDmEfRCz9ZPXSooSy1CzMbeW66kg9uayJp3QW38YdTMFxT
    • CVT deposit tx: 5V72ZK1WejP5Mh3uryEy6BZCV6ukSAnZBFSvHTqfD4NS38xKJUuh4RV5F8D4tDbgMsB2dcTJyZf7hLxH34nCRHRE
    • First major JLP withdrawal tx: 2jCAE2SakEHtaZJbSCftpTGV4RKCYsN7Bd2cwu6nL4sumtmvX9PZrxLFYL4wK5vKBtfyu8S1EN2cTw2vcQPB4QfM
    • Large USDC withdrawal tx: 5cvVsx81CNMSQ3y68oLaDPhDhqH6CJkiZDDoebZRTeNuf8UkoZ4GPnYRxt1BAidg4QtjN8bz7wqxNmJoxt8GTdBS
    • Large cbBTC withdrawal tx: 2vQE6pDmHLfP7dkZLECPMELEAjxePRkm3MKhXDKA8sNBoq7uMGqT5R6UtQXbFznhVsjssj7NTX53YHWKyD5HewPt
    • Attacker-controlled admin address: H7PiGqqUaanBovwKgEtreJbKmQe6dbq6VTrw6guy7ZgL
    • CVT mint: G84LEhbNMR1yYbHgHbnNYNSK8mpTKcazh5jcW5yMPQKo
    • CVT market account: DVYXHwLhwALZm94pChALZDJ2b6a7uZTKPXntAGMQtRoM
    • CVT vault: FzzXwSiwovcAe3BVcc8J4VNPFGKNNsZa2qkPNVuPZnQ5
    • Primary attacker execution wallet: 55udxhScWQxM7cC9d1NPBQoEDC7B38w81EWKPZsM7ZCW
    • Primary recipient / loss-tracking wallet: HkGz4KmoZ7Zmk7HN6ndJ31UJ1qZ2qgwQxgVqQwovpZES
  • Response / mitigation:
    • Drift acknowledged the incident within hours, suspended core protocol functions, and later said all remaining protocol functions had been frozen while the investigation proceeded.
    • The team removed compromised wallets from the Security Council multisig, worked with SEAL 911, forensic partners, exchanges, bridges, Circle, and law enforcement, and published public timelines describing the durable-nonce setup.
    • Later reporting tied the operation with medium-to-high confidence to the same DPRK-linked threat cluster associated with the 2024 Radiant Capital compromise.
    • The aftermath also emphasized controls Drift had lacked at execution time: higher signer threshold, timelock enforcement, dedicated signing devices, stricter transaction verification, and stronger collateral allowlisting / quarantine.

Pattern tags

Why the exploit worked

  • Drift’s signer workflow failed twice at once: first at intent binding, because contributors did not preserve one machine-checkable object across reviewed Squads action → signed durable-nonce transaction → executed admin effect; then at freshness, because durable nonces let those captured approvals remain live until the attacker had already prepared CVT, shallow liquidity, and the cash-out path.
  • The Security Council did not just hold a narrow emergency role. A 2-of-5 quorum with zero timelock could transfer admin authority, list new collateral, choose oracle sources, and raise withdrawal limits on real asset markets in the same short execution window.
  • Drift also lacked a strong independent asset-admission boundary below admin authority. Once the attacker controlled market creation and oracle wiring, the protocol accepted a fresh attacker-manufactured token as borrowable collateral quickly enough that no stronger downstream authenticity check stopped it.
  • Withdrawal containment lived behind the same compromised admin lane. Raising withdraw_guard_threshold on major markets to 500,000,000,000,000 meant the attacker did not need to fight a second, slower control plane after counterfeit collateral was admitted.
  • The attack was therefore not only multisig compromise and not only bad collateral listing. It was one joined failure where poisoned approvals, delayed execution, asset admission, oracle publication, and reserve-withdrawal throttles all sat behind the same captured trust root.

Three stored-approval and admin-cashout promotions this incident collapsed

  1. Some signer-approved admin object still existed at all
    • Drift had real durable-nonce-backed Squads approvals and a live Security Council lane that could still transfer admin authority later.
    • This is only the weakest fact: a stored root-capable object remained reachable for future execution.
  2. That stored object still counted as fresh Security Council authority at execution time
    • The sharper failure was not just that the bytes were once valid, but that Drift still treated months-long socially engineered, nonce-backed approvals as current council intent even after environment drift, signer compromise, and council migration.
    • This is the freshness question: yesterday's captured approval still counted as today's authentic governance authority.
  3. That accepted authority still deserved this much downstream solvency and withdrawal power right then
    • Even after admin capture, a healthier system would not have let the same lane immediately transfer authority, list CVT, choose its oracle, relax collateral controls, raise withdraw_guard_threshold, and cash out deep real-asset reserves.
    • This is the authority-budget question: accepted admin truth still inherited live counterfeit-collateral publication plus near-immediate reserve-release authority.

Detection and audit pivots

  • Preserve and compare the exact reviewed Squads proposal, durable-nonce transaction payload, signer-device prompt, signer-set version, and finally executed admin actions whenever Solana governance or treasury workflows use nonce-backed delayed execution. The central forensic question is whether the approval object that stayed live was still the one humans thought they had approved.
  • Treat durable nonce accounts, queued multisig proposals, partially collected signatures, and other stored admin approvals as live root authority inventory. After any signer compromise suspicion, responders should be able to enumerate and invalidate every still-executable privileged object before attackers choose their execution window.
  • Audit whether one quorum can both capture admin truth and immediately cash it out through asset-admission and withdrawal knobs. If the same lane can transfer authority, list a new collateral market, choose its oracle, relax withdrawal caps, and withdraw reserves without a second delay boundary, the protocol has fused too much solvency power into one ceremony.
  • Stress-test counterfeit-collateral scenarios that begin with compromised governance truth rather than with a user-callable code bug. The right question is not only can someone list a fake asset? but what independent quarantine, liquidity floor, oracle allowlist, or withdrawal brake would still survive if they did?
  • Alert on stored privileged approvals that remain live across signer-set changes, signer-device anomalies, or emergency council migrations. Drift is a reminder that we rotated the council is not a containment story if old durable-nonce authority still executes.

Failure-prevention checklist

  • Treat durable nonce accounts, queued Squads proposals, partially collected admin signatures, and signer-set migration leftovers as live root-authority inventory. If the signer environment becomes suspect, responders should be able to enumerate and kill every still-executable privileged object before attackers choose the broadcast moment.
  • Separate signer-intent review from signer freshness. A signer should approve one exact admin effect bundle, and that approval should either expire quickly or be re-attested when the nonce, signer set, execution window, or proposal shell changes.
  • Do not let one low-threshold emergency council both redefine protocol truth and immediately cash it out. Market listing, oracle admission, collateral-weight changes, withdrawal-cap increases, and admin transfer should not all sit behind the same zero-delay lane.
  • Force fresh collateral through an independent admission boundary even after admin approval: issuer allowlists, liquidity and market-depth floors, independent oracle allowlists, staged borrow factors, delayed withdrawal authority, and route-specific reserve caps.
  • Keep withdrawal throttles outside the same compromised lane wherever practical. If the actor who can list counterfeit collateral can also zero or massively raise outflow guards, the protocol has fused governance capture and reserve release into one ceremony.
  • Rehearse degraded modes for signer compromise that automatically narrow permissions: no new collateral listing, no oracle rewiring, no withdrawal-threshold expansion, lower per-asset outflow limits, and immediate cancellation of stored privileged objects.
  • Preserve a machine-checkable audit trail from reviewed proposal → signed durable-nonce payload → executable Squads object → final onchain effect so investigators can prove whether signers actually approved the action that executed.

Audit prompts

  • Which durable nonce accounts, queued multisig proposals, partially signed admin transactions, or migration-era approvals remain executable tonight, and who can revoke them quickly?
  • If two signers are compromised or deceived, what exact powers still become immediately available: admin transfer, oracle rewiring, new market listing, collateral-parameter changes, withdrawal-cap increases, or reserve movement?
  • Does a signer review one exact effect bundle, or can the proposal shell, signer set, nonce context, or execution object drift after the human review moment?
  • If governance truth is captured, what independent control still prevents a newly created token with attacker-authored liquidity and price data from becoming money-good collateral?
  • Are withdrawal brakes, mint ceilings, and reserve-outflow caps governed by the same path that can admit new collateral, or do they live behind a slower or more independent boundary?
  • After signer rotation, signer-device compromise, or emergency council migration, can responders prove that old stored approvals no longer carry live authority?
  • What telemetry would flag validly signed but economically absurd admin use fast enough: sudden new-market creation, oracle changes to thin assets, giant withdrawal-threshold jumps, or large collateral deposits into a just-listed market?
  • Does the protocol’s public trust story describe the real effective threshold, including durable approvals and zero-timelock emergency powers, or only the visible multisig count?

Lessons that should already be standard

  • Two valid signatures is not the same thing as two humans approved the same admin action at execution time once durable nonces let old review moments stay live.
  • Emergency councils are custody surfaces when they can redefine collateral truth, oracle truth, and withdrawal truth in the same ceremony.
  • Stored privileged objects are part of the live threshold. Rotating signers is not containment if yesterday’s nonce-backed approvals still execute tomorrow.
  • Admin-approved listing is not enough to make an asset safe collateral. Fresh issuer identity, real liquidity, oracle provenance, and reserve-outflow rights need their own quarantine.
  • Withdrawal guards are not meaningful if the same compromised authority can raise them to infinity right before cash-out.
  • Many governance-capture incidents are really solvency incidents one step later: the attacker steals admin truth only because the protocol will then honor counterfeit collateral, bad oracle state, or fake reserves as spendable reality.

Why this incident matters

  • It is one of the cleanest Solana examples of durable-nonce mechanics breaking the comforting assumption that a mistaken signature dies quickly if it is not executed immediately.
  • It also shows how signer compromise and solvency-fiction exploits compose. The attacker did not directly withdraw every reserve by one privileged opcode; instead, they used stolen governance truth to manufacture fake collateral and let Drift’s own accounting pay it out.
  • Finally, it is a high-value reminder that collateral admission is itself an admin-key risk surface. If privileged actors can list any market with any oracle and any withdrawal cap, then multisig hygiene and asset-admission policy are the same security problem.

Internal linkages

Control surface

Graph View

Backlinks