Drift Protocol Opens Onchain Talks Tied to $280M Exploit Wallets

Highlights:

• Drift Protocol has opened on-chain talks with wallets tied to the stolen funds.
• The exploit has expanded, affecting at least 20 Solana protocols.
• Cyvers said the attacker likely prepared the operation days earlier.

The Solana-based decentralized exchange (DEX) Drift Protocol has opened on-chain talks with wallets tied to the $285 million exploit. The protocol said on Friday that it sent messages from its Ethereum address to four wallets linked to the breach. In the post, the team asked the wallet holder to respond through Blockscan chat. The note stayed brief, yet the message was direct. Drift noted, “We are ready to speak.”

Direct Wallet Messages Set the Early Tone of the Response

On-chain outreach has become a familiar tactic after major crypto exploits. Teams use it to speak to anonymous actors without waiting for off-chain contact. In this case, the messages also gave the public a clear view of the first response. As a result, the outreach served as a contact and as a signal.

Critical information of parties related to the exploit have been identified. Drift is now sending an on-chain message from 0x0934faC45f2883dd5906d09aCfFdb5D18aAdC105 to the ETH Wallets that holds the stolen funds.

Wallet 1: 0xAa843eD65C1f061F111B5289169731351c5e57C1 (Timestamp…

— Drift (@DriftProtocol) April 3, 2026

Hours before Drift’s message, another wallet tried a different approach. An unknown sender using the ENS name readnow.eth contacted wallets tied to the exploit. The sender claimed to know who carried out the attack and asked for 1,000 ETH in return for silence. However, no public evidence confirmed that claim.

For that reason, the message raised pressure but not clarity. It also showed how fast unofficial actors can enter the scene after a major exploit. Meanwhile, blockchain records gave analysts a timeline of messages, wallet links, and silence.

Losses Now Spread Across Twenty Solana Projects

The spillover soon reached far beyond a single platform. Data shared by SolanaFloor showed that 20 Solana protocols had direct exposure to the exploit. Therefore, the incident now reflects a deeper problem across connected DeFi systems.

🚨New: @DriftProtocol exposure tracker updated with more Solana projects confirming impact from the $285M exploit. pic.twitter.com/DFhttYeadF

— SolanaFloor (@SolanaFloor) April 2, 2026

Among the affected names were PiggyBank, Perena, Vectis, Valeo, Amp Pay, Loopscale, Prime Numbers Fi, Gauntlet, and Exponent. Some teams moved quickly after reviewing their exposure. Reflect Money, Ranger Finance, and Neutral Trade paused withdrawals. Prime Numbers Fi reported more than $10 million under assessment.

Gauntlet also reported exposure, with estimates placing its impact near $6.4 million. As more projects disclose losses, interdependence becomes harder to ignore. The breach has now shifted into a network-wide stress event.

Security Firms Point to a Longer Setup Before The Breach

Blockchain security platform Cyvers noted on X that the attack had not returned any funds within 48 hours, leading to a low recovery effort. Cyvers described the exploit as a staged operation that unfolded over weeks. 

The sequence began on March 23 with setup activity. Later, the attacker reportedly adapted during a multisig migration on March 27. Then another signer compromise followed on March 30, before execution began on April 1.

$280𝑀 @DriftProtocol 𝐸𝑥𝑝𝑙𝑜𝑖𝑡, 𝑎𝑛𝑑 𝑤ℎ𝑎𝑡 𝑖𝑡 𝑟𝑒𝑎𝑙𝑙𝑦 𝑡𝑒𝑙𝑙𝑠 𝑢𝑠 𝑎𝑏𝑜𝑢𝑡 𝑊𝑒𝑏3 𝑠𝑒𝑐𝑢𝑟𝑖𝑡𝑦

This wasn’t a smart contract failure. It was a failure of trust, processes, and visibility.

𝐓𝐡𝐞 𝐥𝐚𝐭𝐞𝐬𝐭 𝐮𝐩𝐝𝐚𝐭𝐞𝐬
~48 hours later, no funds…

— 🚨 Cyvers Alerts 🚨 (@CyversAlerts) April 3, 2026

The firm also argued that audits and standard Web2 controls do not stop this class of attack. Instead, it pointed to transaction simulation, wallet firewalls, and co-signing checks before approval.

Some market figures also compared the breach to earlier playbooks. Ledger chief technology officer Charles Guillemet said the pattern echoed the Bybit case. Meanwhile, some observers have suggested a possible North Korea link despite no public evidence confirming that theory.