Drift Protocol: No evidence indicates that the mnemonic was stolen; the attack was highly sophisticated and took weeks to prepare.

Mars Finance News: On April 2, Drift Protocol posted that a malicious actor gained unauthorized access through a new type of attack involving a durable nonce, quickly taking over management control of the Drift Security Committee. The attack was highly complex and took weeks to prepare, including using durable nonce accounts to pre-sign transactions for delayed execution. As of now, the investigation indicates that the cause of this incident is not a vulnerability in the Drift protocol or smart contracts; there is no evidence that the mnemonic phrase was stolen. The attacker obtained access by approving unauthorized or forged transactions (possibly involving social engineering). The end result was that approximately $280 million in protocol funds was drained. All lending, vault deposits, and transaction funds were affected. DSOL (not deposited in the Drift portion, including assets staked to Drift validators) and insurance fund assets are not affected; the latter is being withdrawn for protection. As a precaution, all remaining protocol functions have been frozen, and the multisig has been updated to remove the compromised wallets.