Security Incidents

Resolv Labs updated users on the recent exploit that minted 80 million USR tokens. While whitelisted holders have largely redeemed their tokens, non-whitelisted users and RLP holders face delays. Investigations found no insider involvement, but recovery remains uncertain.

Gate News message, on April 2, Wormhole posted on the X platform in response to the Drift Protocol attack incident. Wormhole said that user assets are not currently at risk, and the cross-chain bridge functionality can still be used normally. However, due to the built-in security mechanisms configured for Solana, some cross-chain transfers may experience delays. Wormhole’s core contributors have been in communication with the Solana ecosystem team and will continue to provide support as needed.

Solana Foundation Chief Product Officer Vibhu Norby responded to the Drift Protocol security incident, confirming that an attack occurred. The cause of the attack is still under investigation. The incident is related to operational security or social engineering, highlights the potential risks of multisig mechanisms, and says that this incident does not represent a systemic issue with Solana DeFi.

Ledger CTO Charles Guillemet noted that Drift Protocol’s exploitation method is similar to a 2025 CEX hack incident, and that the security issues mainly stem from people and operations rather than code defects. The attacker infiltrated a multisig device to trick the signer into approving a malicious transaction.

Magic Eden is discontinuing its wallet app, transitioning to an export-only mode, which means users must export their private keys to avoid losing access to their funds. This change emphasizes the importance of self-custody and key preservation for cryptocurrency users.

On April 1, 2026, Drift Protocol in the Solana ecosystem was hacked, resulting in losses of about $285 million. The attacker obtained administrator permissions for a multisig wallet, swiftly withdrew funds, and transferred them cross-chain to Ethereum, becoming the largest single security incident in the DeFi space. The investigation found that the attack was caused by a multisig management configuration flaw: the lack of a time-lock mechanism allowed the attacker to execute malicious actions immediately. The incident caused Drift’s total value locked to drop sharply, significantly impacting the Solana ecosystem.

Google's quantum AI team research indicates that the quantum computing power required to break Bitcoin is far lower than expected, potentially less than 500,000 qubits. Research simulations show that hackers could intercept ongoing Bitcoin transactions within 9 minutes, and that about one-third of the Bitcoin is stored in already exposed wallets, increasing the risk of quantum attacks. While Bitcoin's Taproot upgrade strengthens privacy, it also increases the exposure of public keys, raising the risk to assets.

Li Xiong was extradited back to China from Cambodia, involving a cross-border money laundering case tied to the $4 billion Weiwang Group. The case has exposed the links between the Southeast Asian scam industry chain and crypto funds. Experts noted that the group, as a scam infrastructure provider, supports online scams and the movement of funds. Despite intensified international crackdown efforts, the money-laundering network remains highly adaptable, making it extremely difficult to trace.

All-chain stablecoin protocol USDT0 responded rapidly after the Solana Drift security incident, pausing its cross-chain communication network within 90 minutes. Tether’s CEO praised its team’s handling, while Z achXBT criticized Circle for not freezing USDC transfers.

Gate News message, the Drift Protocol exploiter has purchased an additional 1,195 ETH for $2.46M USDC. The hacker's wallet now holds 130,262 ETH valued at $267.67M. According to Onchain Lens, Drift Protocol was exploited for over $270M, with the stolen funds converted into 129,067 ETH worth $277.4

Chinese police have escorted back to China the key figure Li Xiong, who is alleged to have led the Huione criminal network from Cambodia and faces charges including fraud and money laundering. The network is linked to a global illegal online trading system, which has handled more than $89 billion in crypto assets. Although the core members were arrested, the Huione system is still operating using new methods, reflecting the complexity of laundering crypto assets and the challenges faced by global regulation.

Prince Group’s core member Li Xiong was escorted back to China by the Ministry of Public Security of China on April 1, after being arrested in Cambodia. He is suspected of multiple offenses including fraud and money laundering. He is the chairman of Huowang Group, which is under the Prince Group umbrella. The amount involved in the group’s cryptocurrency business reaches $24 billion, and the money-laundering amount is at least $4 billion. This operation was carried out with cooperation from Cambodia, and it has raised issues related to international judicial cooperation.

Drift Protocol recently suffered a complex attack. Malicious actors used the durable nonce technology to obtain unauthorized administrative privileges, resulting in approximately $280 million in funds being withdrawn. The investigation found no program vulnerabilities; it may involve social engineering. Drift has frozen protocol functionality and updated the multisig to protect assets.

April 2, the Drift attack incident affected multiple DeFi protocols, including Reflect Money and Ranger Finance, among 11 projects. Some projects paused features such as minting and withdrawals. Ranger Finance lost about $900,000, accounting for 6% of its total value; Pyra also paused the relevant functions because users’ funds were affected.

Google releases a white paper warning that quantum computers may break Ethereum, putting hundreds of billions of dollars in assets at risk. The report points out that there are multiple vulnerabilities in systems such as giant whale wallets, DeFi management keys, and staking systems, and that a high level of alertness is needed. The Ethereum Foundation has already launched research into post-quantum cryptography and plans to carry out a system upgrade before 2029.

Gate News, April 2, Wormhole issued an official response to the attack on Drift, stating that Wormhole users’ assets are not currently at risk and that the cross-chain bridge functionality can still be used normally. However, due to the built-in security mechanisms configured for Solana, some cross-chain transfers may experience delays. Wormhole’s core contributors have been in communication with the Solana ecosystem team and will continue providing support as needed.

Loopscale’s declaration is not directly related to Drift. Most funds are secure, with some indirect exposure. Deposits in the SOL Genesis Vault will fully reimburse users; deposit and withdrawal functionality is temporarily disabled, and will be reopened once services are restored.

Decentralized exchange Drift Protocol was hacked on April 2, resulting in losses of up to $280 million, becoming one of the largest DeFi security incidents in the Solana ecosystem. The attacker exploited a multisig vulnerability to obtain administrator keys and quickly transferred assets. Drift has paused deposits and withdrawals and has promised to continue updating the incident investigation. Security experts noted that this incident highlights the risks of high-privilege key management for DeFi protocols, urging stronger security measures to protect users’ assets.

Trust Wallet’s Discord short link was hijacked and points to a malicious phishing server. Users should immediately stop clicking the relevant links and wait for official confirmation that they are safe. The newly released address poisoning protection feature can actively screen for potential scam addresses. Since 2025, Trust Wallet has faced multiple security challenges, so users need to take precautions.

Drift Protocol draws attention after a hacking incident. The DRIFT token plunged 28% in a single day; the current price is only $0.049, down as much as 98% from its all-time high. The attacker stole $285 million after a private key leak and converted it into ETH; the service has been suspended. The incident has raised questions about the security of the Solana ecosystem, and the market is closely watching the follow-up compensation plan and investigation results.