Incident Background Update
Contents
Drift is actively working with law enforcement, forensic partners, and ecosystem teams to build a complete picture of what happened during the April 1st attack.
As the investigation of the attack occurring on April 1st 2026 continues alongside forensics partners, more details can now be shared about the attack vector and how this operation was staged. Drift is sharing this publicly because other teams in the ecosystem deserve to understand what this attack actually looked like, and to protect themselves accordingly. Some details remain high-level to protect the integrity of the active investigation.
Current Status
All remaining protocol functions have been frozen and the compromised wallets have been removed from the multisig. Attacker wallets have been flagged across exchanges and bridge operators.
Mandiant has been engaged for the investigation.
An Attack 6 Months in the Making
The preliminary investigation shows that Drift experienced a structured intelligence operation requiring organizational backing, significant resources, and months of deliberate …
As the investigation of the attack occurring on April 1st 2026 continues alongside forensics partners, more details can now be shared about the attack vector and how this operation was staged. Drift is sharing this publicly because other teams in the ecosystem deserve to understand what this attack actually looked like, and to protect themselves accordingly. Some details remain high-level to protect the integrity of the active investigation.
Current Status
All remaining protocol functions have been frozen and the compromised wallets have been removed from the multisig. Attacker wallets have been flagged across exchanges and bridge operators.
Mandiant has been engaged for the investigation.
An Attack 6 Months in the Making
The preliminary investigation shows that Drift experienced a structured intelligence operation requiring organizational backing, significant resources, and months of deliberate …