Drift discloses attack details: Multi-signature was compromised and attacks were carried out using pre-signed transactions.

Drift Protocol disclosed the execution process of this security incident, stating that the attack began with a test withdrawal transaction initiated from an insurance fund. Approximately one minute later, the attacker seized administrator privileges and executed subsequent operations through two pre-signed durable nonce transactions. The project team stated that the attack was caused by multiple factors, including the delayed execution of pre-signed transactions and the breach of multi-signature approval, possibly related to targeted social engineering attacks or transaction misrepresentation. Drift is currently collaborating with multiple security agencies to investigate the cause and is working with cross-chain bridges, exchanges, and law enforcement agencies to track and freeze related funds. A detailed review report will be released later.