A major decentralised finance (DeFi) platform has suffered a suspected exploit exceeding $270 million, with onchain data showing large volumes of assets rapidly moved to a single wallet.
Blockchain analytics accounts first flagged the activity late on April 1, with Lookonchain stating,
“Drift Protocol appears to have been exploited, with over $270M in assets suspiciously transferred to wallet HkGz4K.”
Separate tracking from Solana-focused sources also pointed to a nine-figure breach, with early estimates ranging above $200 million as transactions unfolded in real time.
Onchain data suggests the exploit began around 4 PM UTC, starting with a transfer of $155 million worth of JLP tokens from a Drift vault.
The suspected attacker's wallet showed multiple large inflows across tokens, suggesting coordinated draining of protocol-linked vaults.
The hacker has deposited SOL tokens to Hyperliquid and Binance exchanges and purchased more than $82 million worth of Ethereum (ETH), as per Lookonchain.
The protocol acknowledged "unusual activity" but didn't confirm the hacking incident. However, it asked users to not deposit funds.
“We are observing unusual activity on the protocol. We are currently investigating. Please do not deposit funds into the protocol while we investigate. This is not an April Fools joke. Proceed with caution until further notice. We’ll provide additional updates from this account,”Drift said.
More on Hacks:
Token drops as markets react to exploit
The platform’s native token, DRIFT , fell sharply following the incident, reflecting broader market concerns around protocol security and potential liquidity impact.
Market data shows the token declining more than 13% over a 24-hour period, with a steep drop occurring shortly after the suspicious transfers were flagged.
Onchain flows indicate a mix of assets, including USDC and other tokens, were moved in large batches, with individual transfers reaching tens of millions of dollars.
The rapid movement of funds - estimated at over $270 million within roughly an hour - intensified selling pressure, as traders reacted to uncertainty around the scope of the exploit and potential recovery.
Such incidents often trigger immediate liquidity exits, particularly in DeFi ecosystems where user confidence is closely tied to protocol security.
This story was originally published by TheStreet on Apr 1, 2026, where it first appeared in the MARKETS section. Add TheStreet as a Preferred Source by clicking here.
