区块链闲人🔶BNB
599 posts


** Correction on key compromise ** A week ago, Drift moved to a new multisig, created by a signer from the old multisig. This signer did not add themselves to the new one. The exploiter also initiated the proposal in the old multisig to hand over admin control to this new wallet. Of the 5 signers on the new multisig, only 1 came from the previous setup; the other 4 were brand-new. The wallet was set with a 2/5 threshold and a 0-second timelock. ~Five hours ago, that sole carryover signer used the new multisig to propose changing Drift’s admin. One of the new signers co-signed a second later, instantly meeting the 2/5 threshold. With no timelock in place, the transaction was executed immediately. ** Note ** Some of the relevant Solana programs are not verified, which limits full analysis. We're continuing to dig into the onchain data and will publish a more thorough post-mortem covering the multisig migration, Solana DeFi contagion, and vault exposure in a follow-up.































