🚨 $285 million drained from Drift on Solana—with no vulnerabilities in the code. The attacker exploited Solana’s “durable nonces”—a completely legitimate transaction feature. They pre-signed admin transfer instructions weeks in advance, bypassing multisig in minutes with surgical precision. Even more troubling: ZachXBT criticized Circle for its slow response, failing to freeze the stolen USDC in time. Circle’s reply: “We cannot freeze funds without a court order.” · The protocol had zero code vulnerabilities—and was still drained. · It wasn’t that the hacker was brilliant; it was that the underlying trust assumptions were dangerously weak. · Multisig ≠ security—DeFi must keep learning this lesson the hard way. Using legitimate features for illegitimate purposes—that’s the most terrifying kind of attack. Guard your bullets 🧊