Drift Protocol Exploited: $270M Assets Sent to HkGz4K
Drift Protocol, the Solana SOL +0.00% -based perpetual futures exchange, disclosed on April 1, 2026 that it was experiencing an active exploit, with on-chain analysts estimating over $270 million in assets were transferred to a wallet beginning with HkGz4K. The protocol immediately suspended deposits and withdrawals as DRIFT tokens fell nearly 25% within hours.
What Happened in the Reported Drift Protocol Exploit
Drift Protocol confirmed the attack in a public statement on April 1, noting it was coordinating with multiple security firms, bridges, and exchanges to contain the incident. Deposits and withdrawals were suspended while the team assessed the damage.
On-chain analytics firm Lookonchain was among the first to flag the suspicious activity, identifying wallet HkGz4KmoZ7Zmk7HN6ndJ31UJ1qZ2qgwQxgVqQwovpZES as the destination for what it described as over $270 million in transferred assets. The full scope of the loss has not been independently reconciled across all reported transactions.
Solana blockchain records show at least two large transfers into a token account owned by the HkGz4K wallet. One transaction moved 26,073,680 units of a token mint into the account, raising its balance to exactly 49,000,000 units. A prior transaction had already deposited 11,544,288 units into the same account.
ON-CHAIN DATA
- Transaction: 2uGwwa…E1dB
- Amount: 26,073,680.249748 units of mint EAbAnw…pump
- Destination: Token account EQ5ukT…6QeU, owned by HkGz4K…
- Resulting balance: 49,000,000 units
- Timestamp: April 1, 2026, 21:05 UTC
According to unconfirmed reports from early media coverage, the asset-by-asset breakdown included 41.72 million JLP, 51.616 million USDC USDC +0.00% , 125,000 WSOL, and 164,349 cbBTC, with Drift vault holdings reportedly falling from $309 million to $41 million. These figures have not been independently verified transaction by transaction.
DRIFT Token Crashed as Fear Spiked Across Markets
Helius CEO Mert Mumtaz was among the earliest prominent voices to raise the alarm publicly, warning users to monitor their positions before Drift had issued its official confirmation.
not 100% fully certain yet, but it seems drift might be getting exploited
monitor your positions https://t.co/xaHqJNDHg2
— mert (@mert) April 1, 2026
Source: @mert on X
The market reaction was swift. DRIFT traded at $0.05107, down 24.83% over 24 hours, with roughly $29.09 million in trading volume as sellers rushed to exit positions.
DRIFT’s market capitalization fell to approximately $29.68 million. The broader crypto Fear and Greed Index sat at 8, firmly in “Extreme Fear” territory, reflecting the sharp negative sentiment surrounding the incident.
If the reported $270 million figure holds, this exploit would rank among the largest DeFi security breaches in 2026 and one of the most significant on Solana to date. The scale of the transfer, combined with the speed at which vault assets reportedly drained, underscores the concentrated risk in permissionless lending and trading protocols.
What to Watch as the Investigation Develops
The most critical next step is an official post-mortem from Drift Protocol detailing the attack vector, confirmed losses, and any recovery path. As of publication, the team has confirmed the attack and suspended platform activity but has not released a full incident report.
On-chain investigators and security firms are expected to trace the movement of funds from wallet HkGz4K to determine whether assets have been bridged to other chains, swapped through decentralized exchanges, or moved to centralized platforms where they could potentially be frozen.
Users with open positions or funds deposited in Drift vaults should watch for official communications regarding the timeline for resuming withdrawals. Drift stated it was coordinating with exchanges and bridge operators, which could indicate efforts to blacklist the attacker’s addresses and recover funds.
Until the protocol publishes a confirmed loss figure and technical breakdown, the over $270 million estimate should be treated as a preliminary number reported by on-chain analysts, not a final accounting. The gap between early estimates and confirmed losses in DeFi exploits can be significant in either direction.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
