Drift Protocol suspends withdrawals after Security Council takeover drains hundreds of millions

What happened

Drift Protocol reported an active security incident after an attacker gained administrative control and executed malicious transactions that drained a large share of protocol funds.

Public reporting puts the loss in the $280M–$285M range, with the protocol pausing deposits and withdrawals while investigating and coordinating containment.

Why this matters

For users, this is a custody and liquidity event: when protocol controls are abused, normal assumptions about withdrawals, balances, and market operations can break quickly.

Even if smart-contract code itself was not directly exploited, compromised governance/admin paths can create the same end-user outcome: funds inaccessible or lost.

How to check if you’re affected

Affected versions: All Drift Protocol deployments handling user deposits/withdrawals at incident time (April 1, 2026), until Drift confirms remediation and normal operations are safely restored.

You are likely affected if you had funds on Drift during the incident window.

Check your wallet history
- Review all Drift-related transactions and token balances around the incident date.
- Capture wallet addresses and tx hashes for records.
Verify protocol status before interacting
- Confirm deposits/withdrawals/trading status via Drift official channels and trusted trackers.
- Do not add new deposits until full recovery guidance is published.
Reassess wallet permissions
- Revoke stale approvals tied to affected dApps.
- Rotate wallet operational practices if you used automation/signers in high-value flows.
Document loss and exposure now
- Export balance snapshots and timestamps for any insurance/legal/recovery process.
- Track recovery announcements and any claims process from protocol operators.

Immediate defensive actions

Pause interactions with affected DeFi contracts until postmortem and remediation are complete.
Revoke unnecessary token approvals from hot wallets.
Split operational funds across risk tiers instead of concentrating assets in one protocol.
Require stricter multisig and signer hygiene for treasury/DAO operations.

Sources

Bottom line

If you hold assets connected to Drift, treat this as an active incident: verify exposure, avoid new deposits, and wait for confirmed remediation and recovery guidance before resuming normal use.