Drift was robbed of $285 million and its coin price instantly halved! This is likely the beginning of the collapse of the entire DEFI narrative! Early this morning, there was still $309 million in the Drift vault. One hour later, there were only 41 million left. The stolen amount exceeded 280 million US dollars. This is not some April Fool's joke. Because the drop in coin price cannot create counterfeit, it instantly plummeted from 0.072 to 0.04, directly cutting in half. The team also immediately declared: This is not an April Fools joke. For the cryptocurrency market, which is already in a bear market, this is really a case of breaking houses and continuous rain. Because this project has always been one of the top defi protocols in the Sol ecosystem and is also related to many Sol header protocols, such as Jup KMNO, many projects have suffered losses as a result. And this 280 million yuan amount is also the largest loss amount for the Sol ecosystem since Wormhole was stolen in 2022. But when $w was stolen, it was a bull market, and now it's a bear market. The remaining liquidity in the market has been drained by hackers. According to the projects stolen in previous bear markets, it can be said that this project is already dead. But that's not even the scariest thing. The scariest thing is that now is a critical juncture in the negotiation of the encryption clarity bill, and this accident will tighten the previously loose regulatory policies again, with the potential impact far greater than the project itself. Being pessimistic could trigger a collapse of faith in the entire DEFI forum, and today the DEFI agreement collective is in a state of diving. 1. The most embarrassing part of this time: the method of death is not advanced at all Many people immediately think of complex contract vulnerabilities, lightning loans, and cross chain attacks when they hear about 280 million. But the most eye-catching part this time is precisely not these. The current path on the chain is more like losing permissions first, and the oracle is also under control. Administrator privileges refer to the master key that can modify key protocol parameters, activate the vault, and pass governance proposals. The oracle is the eye that determines the price based on the protocol. It's only a matter of time before the keys are taken away, the eyes are covered again, and the vault is emptied. What's even uglier is that this method of death is too old. You're too old to say this is in 2026. DeFi has been promoting security, transparency, and permissionless for so many years, but in the end, it still collapsed in the oldest link: Who is in charge of permissions. Who is keeping the private key. Who is quoting for assets. 2. How to do the attack: first create air, then turn the air into money At present, it is more like this line on the chain. The attacker first prepared a fake token with almost no value, CVT。 Then I prepared a Switchboard oracle that I could control myself. Switchboard is one of the common oracle solutions in the Solana ecosystem. To put it simply, I made a pile of waste paper and then set an outrageous price for it. Later, through multiple signatures and loopholes in the governance layer, this counterfeit currency was inserted into Drift's collateral system. The most crucial steps are to convert the CVT into a collateralized asset, connect the attacker controlled quotation source, and directly increase the collateral weight. By this point, the protocol has actually been changed to an ATM. Because all the subsequent actions are very mechanical. Deposit into CVT. Read the manipulated high price. Take this pile of air and borrow real money. USDC、USDT、WBTC、SOL、LST、LP， Moving out round by round. LST is a liquid collateral token. LP stands for liquidity position. The whole process is like a script running, every 30 to 60 seconds, without much emotion, pure assembly line. This is the most disgusting place. Hackers don't do it once. It's about letting the agreement spit out the money one by one. 3. The retreat route is also very professional: this is not a last-minute idea, it has been rehearsed After obtaining the assets, the attacker did not panic. The route is very clear. Part of the assets will be processed on Jupiter first. Jupiter is the largest aggregated transaction router on Solana. Swap various currencies for assets that are more convenient to handle first. Further disassemble through paths such as Circle CCTP, Wormhole, and Mayan. CCTP can be understood as the official cross chain channel of Circle. Wormhole is well-known to everyone. Mayan also works in cross chain liquidity. Some SOL and other assets are also moving directly towards centralized platforms and high liquidity locations. This retreat method is no longer about "stealing and then finding a way to run". Before entering, the road was already paved. And they had already done a small test the day before. Can the bridge go. Is the liquidity sufficient. Which path has the smallest sliding point. Which address splitting is most convenient. Try these things first. Then wait for the team with the slowest response window to work hard. So this matter cannot be fooled by 'bad luck'. They are not here to take a chance. They came with a script. 4. The real thunder is still behind: what was knocked down this time was not a single project, but the tone of the entire sector The most dangerous part of Drift this time is not just losing money. It happened at a very wrong time. Bear market. Liquidity is already thin. Market sentiment is inherently fragile. Regulatory negotiations are stuck at the most critical moment. At this point, another major Solana ecosystem level project will not only have an impact on Drift. The project itself is highly likely to have been abandoned. In a bear market, there are already few examples that have survived being stolen like this. But bigger issues lie ahead. Regulators will keep an eye on this matter. Traditional funds will focus on this matter. People who were originally willing to give DeFi some space will also take it back because of this accident. Many things that were originally intended to be relaxed may now need to be tightened again. Even more troublesome is that the market will start to rethink one thing: Is DeFi a "decentralized finance" or a "permission game disguised as decentralization". Only a few keys can determine the life or death of the vault. As long as the oracle can still be controlled by humans. As long as the governance layer can still be infiltrated. Many protocols may appear decentralized on the surface, but deep down they still rely on trust chains to hold their breath. Once this breath breaks, it's not just a Drift that will collapse. The most expensive thing in the entire sector is confidence.