The Drift Protocol hack, months of built trust, 12 minutes to empty it all
Listen to the audio version
The article on social engineering described pretexting as building a credible scenario before acting. The Drift Protocol hack, a decentralized exchange on the Solana blockchain, shows what that same principle looks like when applied with the resources and patience of a nation-state rather than an individual.
What happened
On April 1, 2026, attackers drained about $285 million from Drift Protocol in just 12 minutes. Several blockchain security firms, including Elliptic and TRM Labs, attributed the attack to actors linked to North Korea, notably the Lazarus group, based on the traceable path of the stolen funds toward Tornado Cash, a deployment timestamp matching Pyongyang's time zone, and a social engineering approach already seen in the 2022 Ronin bridge hack, also attributed to the same group.
Months of a built relationship before any technical action
Unlike most DeFi hacks, which directly exploit a code flaw, this attack began well before any technical move: individuals posed as legitimate developers and institutional partners, building a genuinely trusted relationship with the Drift Protocol team over several months. By the time the technical part of the attack began, the attackers had already earned the trust of the very people responsible for protecting the protocol's funds.
The governance mistake that made it all possible: removing the timelock
On March 27, 2026, just days before the attack, Drift Protocol migrated its Security Council to a new signature threshold and removed its timelock. A timelock normally imposes a delay, often 24 to 72 hours, between approving a sensitive administrative action and it actually taking effect, a delay that gives a team time to spot and block a suspicious action before it goes through. That removal, driven by a wish to make certain operations faster, instantly wiped out the one safety net that could have slowed the attacker down once the signatures were obtained.
Durable nonces, a legitimate tool turned against its purpose
The attackers convinced several of the protocol's legitimate signers to sign transactions presented as routine, using a legitimate Solana feature called "durable nonces," which allows a signed transaction to be prepared in advance and executed later, at a chosen moment. Once obtained under an innocuous pretext, these signatures became ready-to-use authorizations, held in reserve by the attackers until the moment they themselves chose to activate them.
Execution: 12 minutes after months of preparation
On April 1, the attackers activated these pre-prepared transactions, registered a fraudulent token as valid collateral on the protocol, raised the withdrawal limits, then deposited a massive amount of that worthless token as collateral, against which the protocol's risk engine issued real assets in exchange. This entire sequence, painstakingly prepared over months, played out in just 12 minutes once triggered.
Why this looks like social engineering, at an entirely different scale
The principle stays identical to the one described in the article on social engineering: build credible trust before exploiting it, rather than forcing a technical door directly. The only real difference lies in the scale and patience involved: months of methodical preparation rather than a simple phone call, resources befitting a nation-state rather than a lone individual. The end result follows the same pattern: it wasn't code that was deceived, it was people.
What this actually changes
For a DeFi project or a DAO (see the dedicated article), this incident illustrates a direct governance risk: a safety mechanism like a timelock exists precisely to create a window for human reaction, and removing it to gain speed eliminates, in the same move, the last line of defense against exactly this kind of attack. For everything else, the lesson ties directly back to one already drawn elsewhere on this site: earning someone's trust over time remains one of the most effective and hardest-to-detect attack vectors there is, whatever scale the target happens to be.