Drift turned into one of the largest Solana exploits, over $285M drained after a multi-sig compromise that let the attacker take admin control. The exploit itself was an orchestration: fake collateral (CVT), oracle manipulation, then cross-margining into real assets like SOL,

The Drift hack wasn’t a code exploit. It was social engineering using Solana’s durable nonces. Quick explainer on durable nonces ↓ Normally, Solana transactions include a recent blockhash that expires in ~90 seconds. Miss the window and the signed transaction dies. Durable nonces remove that expiry. Instead of a blockhash that dies in 90 seconds, you substitute a stored nonce value from a special on chain account. That nonce doesn't expire until someone manually advances it or submits the transaction. A signed transaction using a durable nonce can sit in someone's pocket for days, weeks, months. Still valid. Still executable. The signer has no visibility into when or whether it gets used. This exists for good reasons: multisig wallets where signers are in different time zones, cold storage setups, custodial services that need offline signing. But it fundamentally changes the threat model. How it was weaponized: - Mar 23: Attacker created four nonce accounts (two tied to Drift security council members). - Mar 23–30: Collected 2/5 multisig signatures on “routine” transactions. - Those signatures didn’t expire, they sat usable for days. - Apr 1: Attacker submitted two pre-signed transactions four slots apart: admin takeover, limits removed, vaults drained. ~$280M gone. Without durable nonces, the attacker would’ve had to trick signers and execute inside a 90-second window. Nonces stretched that window to over a week, letting them gather signatures slowly. No seed phrases leaked. Audits passed. The failure was a 2/5 multisig with no timelock plus a transaction format that separates signing from execution.

【$AIOTUSDT Signal】Pullback confirmation, secondary upward attack $AIOTUSDT After a volume breakout on the 4H timeframe, the price retraced to above the middle band of the Bollinger Bands. The MACD fast and slow lines are above the zero line and are converging, indicating that bullish momentum has not yet exhausted. This oscillation is quite testing traders' patience, but the position remains stable, suggesting that funds have not left the market, only clearing out short-term positions. 🎯Direction: Long ⚡Entry/Order: Batch entries in the 0.0341 - 0.0353 range 🛑Stop Loss: 0.0246 🚀Target 1: 0.0777 🚀Target 2: 0.0990 🛡️Trade Management: - Execution strategy: After reaching Target 1, reduce position by 50% and move the stop loss to break-even. If the price falls back into the entry zone, exit automatically to protect capital. The 4-hour RSI is around 66, showing healthy pullback without entering the overbought zone. The price is steadily above the EMA20, which is characteristic of a strong consolidation. Coupled with the pre-market battle phase in the US stock market, this sideways movement often indicates a buildup before the next rally. Buying depth is balanced, with no obvious selling pressure gaps, and the funds are clearly supporting the bottom. View real-time market 👇 $AIOTUSDT --- Follow me: Get more real-time analysis and insights on the crypto market! $BTC $ETH $SOL ‍#Gate广场四月发帖挑战 #加密市场行情震荡 #国际油价走高