Drift Protocol: No evidence indicates that the mnemonic phrase was stolen; the attacker gained access through unauthorized transaction approvals.

Deep Tide TechFlow message. On April 02, according to the official disclosure from Drift Protocol (@DriftProtocol), on April 2, a malicious attacker rapidly took over Drift Protocol’s Security Committee management privileges through a new attack method involving durable nonces. The attack was prepared over several weeks and executed in phases; the attacker delayed execution through pre-signed transactions and, using social engineering or transaction misdirection, obtained approval from a multisig wallet (2/5), ultimately completing a malicious transfer of protocol-level privileges.

The Drift team stated that this incident was not caused by a smart contract vulnerability or a leaked seed phrase. The affected scope includes lending deposits, insurance inventory deposits, and trading funds, but DSOL that was not deposited into Drift (including assets staked to Drift validators) and insurance fund assets are not affected.