The collapse of governance logic triggered a catastrophic event: In just 10 seconds, Drift lost $220 million, causing a chain reaction of failures within the Solana ecosystem.

The core lending protocol in the Solana ecosystem, Drift, suffered a devastating security attack early this morning. Within just ten seconds, over $220 million in user assets were illegally transferred. As a result, the price of Drift tokens plummeted by more than 40%, reducing their fully diluted value to approximately $44 million. This incident also caused severe fluctuations in popular tokens such as SOL and JUP.As a leading project in the Solana ecosystem that has raised over $52 million in funding, Drift had previously received support from top institutions including Multicoin Capital, Polychain, Robot Ventures, Blockchain Capital, Ethereum Ventures, and Jump Capital. However, this sudden accident not only dealt a heavy blow to the project but also rapidly undermined the trust in the entire on-chain lending market.According to Woofun AI, the root cause of the attack was the illegal acquisition of control over multiple-signature addresses and the systematic failure of the governance logic, exposing the vulnerability of DeFi frameworks under extreme circumstances. The crisis actually began a week earlier when the project moved management permissions from an old multi-signature wallet to a new one without including the relevant signatories in the new system, creating a fatal flaw.The attacker took advantage of this flaw by proposing to transfer administrative rights to an account under their control within the old multi-signature wallet. Although the new wallet had five signatories, only two out of five were required to approve the transfer, and there was no time limit (0-second delay). At the critical moment early this morning, the remaining old signatory and one new signatory jointly voted quickly, completing the transfer of rights without any waiting period.Once in control, the attacker established a sophisticated scheme to manipulate prices. They first created a new spot market called CVT within the protocol. With a total supply of approximately 750 million tokens, the attacker held 600 million of them. Then, they used the SwitchboardOnDemand predictor under their control to conduct 20 high-frequency transactions, artificially driving up the price of CVT tokens from near zero to give their 600 million tokens a fictitious value of hundreds of millions of dollars on paper.Using this manipulated price as a benchmark, the attacker withdrew assets worth between $220 million and $280 million from the protocol, including approximately $155 million in Jupiter LP tokens (JLP), 51.61 million USDC, and cbBTC worth around $11.29 million. The interoperability between DeFi protocols turned from an advantage into a accelerator for risk propagation at this point. This modular structure allowed the risks to spread rapidly throughout the entire Solana ecosystem, like dominoes falling one after another.Jupiter was the most severely affected party in this incident. Its perpetual contract market faced a double crisis: a shortage of liquidity and panic-driven withdrawals due to the theft of a large amount of JLP tokens. As a result, the price of JUP tokens came under pressure. In addition, more than 15 DeFi protocols that integrated into the Drift lending market, such as Perena, Project 0, Exponent, Carrot, Ranger, PiggyBank, Reflect, Elemental, Neutral Trade, Pyra, Fuse, and XPlace, were also affected. Some of these projects had to temporarily suspend withdrawal functions to contain the risks.These consecutive high-frequency security incidents are systematically eroding users’ confidence in the DeFi sector. A large amount of funds from established on-chain projects have been withdrawn, and market sentiment has shifted from aggressive to highly defensive. Well-known community members have stated that, given losses of over $6,000 per transaction, the current environment is not suitable for reckless investments. Unless there is a deep understanding of a particular new project, withdrawing funds is currently the only rational strategy for survival. This indicates that the industry is entering a period of profound trust reconstruction.