Drift Protocol, a Solana-based decentralized exchange, said Friday it had opened onchain contact with wallets tied to funds stolen in an exploit outside firms have estimated at roughly $280 million to $286 million.
Drift said on X that it had initiated onchain messages from its Ethereum address (0x0934faC) to four wallets linked to the exploiter, urging the attacker to reach out via Blockscan chat. “We are ready to speak,” the team wrote.
Onchain messaging has become a common tactic for exploit response, enabling protocols to communicate directly with attackers while preserving anonymity. Similar outreach in past cases, such as the Euler Finance hack, helped secure partial recoveries.
An anonymous sender using the ENS name readnow.eth also contacted wallets linked to the attacker on Thursday, claiming to know identities behind the attack and demanding 1,000 ETH to withhold information. Those claims could not be independently verified and may represent an attempt to mislead or pressure the wallet holder.
The fallout on Solana keeps spreading. According to SolanaFloor, Drift’s exploit has affected at least 20 Solana protocols, including DeFi platform Gauntlet, estimated to have lost about $6.4 million. Blockchain security firm Cyvers said the impact was still expanding as of Friday morning, with no funds recovered 48 hours after the attack.
Cyvers described the operation as likely a “weeks-long, staged operation,” noting the attacker used durable nonces — a Solana feature that lets users pre-sign transactions for future execution — days before the exploit. The firm said the pattern mirrors the Bybit hack in that signers may have unknowingly approved malicious transactions.
Some observers, including Ledger CTO Charles Guillemet, have suggested the exploit may involve North Korea-linked actors, though those allegations remain unconfirmed.
Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently. Read our Editorial Policy https://cointelegraph.com/editorial-policy