On April 1, 2026, Drift Protocol on Solana was exploited for ~$295M when attackers tricked Security Council members into pre-signing transactions via Solana durable nonces, handing over admin control. Attackers whitelisted a worthless fake token (CVT) as collateral, deposited 500M CVT, and withdrew $285M in real assets (USDC, SOL, ETH) in ~12 minutes. Security firms linked the attack to DPRK/Lazarus Group.