A sophisticated exploit targeting Drift Protocol appears to have drained an estimated $285 million after an attacker manipulated oracle pricing using a fabricated token, leveraged a compromised admin key and disabled core withdrawal safeguards.
Fake Collateral Built Weeks In Advance
According to on-chain analysis shared by independent researcher Ares, the exploit began weeks before the actual drain. The attacker minted 750 million units of a fake asset called “CarbonVote Token” (CVT) and created a liquidity pool on Raydium (RAY) with just $500 in liquidity, artificially setting its price near $1.
Over several weeks, the attacker reportedly wash traded the token to build a credible on-chain price history, allowing it to be picked up by oracle mechanisms as legitimate collateral value.
Admin Key Compromise And Safeguard Removal
On April 1, the attacker used a compromised Drift admin key to list CVT as a spot market. In the same transaction, withdrawal guard thresholds across multiple markets were raised to extreme levels, effectively disabling limits designed to prevent large outflows.
Also Read: Bitcoin Redistribution Phase Echoes Q2 2022 Bear Market - Glassnode Report
The attacker then deposited approximately 785 million CVT, valued at $785 million based on the manipulated oracle price, across multiple accounts.
Vaults Drained In Minutes
Using the inflated collateral, the attacker executed 31 withdrawal transactions in roughly 12 minutes, draining assets across multiple vaults.
These included $66.4 million in USDC, $42.7 million in JLP, $23.3 million in MOODENG (MOODENG) and smaller amounts of other tokens.
Funds were subsequently consolidated, partially burned through perpetual liquidity removal and converted into SOL before being distributed across multiple wallets.
The use of multiple signing keys suggests either a broader compromise of operational infrastructure or access to privileged credentials, raising further concerns about internal security controls.
Read Next: CLARITY Act Stablecoin Deal Could Come Within 48 Hours, Coinbase CLO Predicts
