An attacker drained approximately $285 million from Drift Protocol after obtaining pre-signed Solana durable-nonce transactions from Security Council members and using them to seize administrative authority. The attacker created a falsely valued token, assigned an attacker-controlled oracle, removed withdrawal constraints, and borrowed real assets against 500 million units of phantom collateral. Blockaid traced the proceeds through Jupiter, deBridge, Wormhole, Ethereum addresses, mixers, Hyperliquid, and Binance, and identified a zero-second timelock and weak governance controls as major enabling factors.