TLDR Tech / InfoSec
Drift Loses $285 Million in Durable Nonce Social Engineering Attack Linked to DPRK
Drift lost $285 million on April 1 after attackers used durable nonce accounts to pre-sign delayed transactions and socially engineered enough multisig approvers to seize Security Council admin rights. The attacker then created a fake token called CarbonVote with minimal liquidity, tricked Drift's oracles into accepting it as collateral, removed withdrawal limits, and drained all major vaults in 10 seconds.
Read the full story