Key Points
- Drift dispatched on-chain communications to four Ethereum addresses connected to misappropriated assets.
- Communications originated from the wallet address 0x0934faC45f2883dd5906d09aCfFdb5D18aAdC105.
- The protocol announced it has identified individuals associated with the security breach.
- The exploitation method utilized durable nonce transaction mechanisms.
- Drift has enlisted security specialists, cryptocurrency exchanges, and legal authorities in the investigation.
Drift Protocol has reached out directly to four Ethereum wallet addresses allegedly containing assets from its recent security breach, according to a public statement from the team. The platform indicated that crucial intelligence regarding individuals connected to the exploitation has been uncovered and that communication channels via Blockscan chat are now open. The outreach originated from the wallet 0x0934faC45f2883dd5906d09aCfFdb5D18aAdC105.
The targeted Ethereum addresses include 0xAa843eD65C1f061F111B5289169731351c5e57C1, 0xD3FEEd5DA83D8e8c449d6CB96ff1eb06ED1cF6C7, 0xbDdAE987FEe930910fCC5aa403D5688fB440561B, and 0x0FE3b6908318B1F630daa5B31B49a15fC5F6B674. The protocol team disclosed precise timestamps for each communication dispatched on April 3, 2026, spanning from 05:17:23 AM UTC through 05:25:11 AM UTC. Additional information will be released following completion of third-party attribution analysis, the team confirmed.
Critical information of parties related to the exploit have been identified. Drift is now sending an on-chain message from 0x0934faC45f2883dd5906d09aCfFdb5D18aAdC105 to the ETH Wallets that holds the stolen funds.
Wallet 1: 0xAa843eD65C1f061F111B5289169731351c5e57C1 (Timestamp…
— Drift (@DriftProtocol) April 3, 2026
This development follows Drift’s revelation that an unauthorized party infiltrated the protocol using an innovative attack vector leveraging durable nonce mechanisms. The platform explained that this exploitation method facilitated a swift seizure of Drift’s Security Council administrative capabilities. Evidence suggests the operation required multiple weeks of preparation and was executed in calculated stages, according to the company.
Protocol Explains Attack Mechanics and Security Failure
In previous communications, Drift explained that the vulnerability stemmed from pre-authorized durable nonce transactions that permitted deferred execution. The company also indicated that the incident included the compromise of authorizations from several multisig participants, presumably through sophisticated social engineering tactics or transaction obfuscation. Drift has clarified that the breach did not result from a fundamental smart contract vulnerability.
The platform initially alerted users on April 1 about suspicious behavior and recommended suspending deposits during the inquiry. Subsequent updates on April 2 offered greater clarity regarding the attacker’s apparent acquisition of administrative control. According to Drift, the utilization of durable nonce accounts allowed pre-authorized transactions to remain dormant until strategically activated at a predetermined moment.
The incident captured significant attention throughout the cryptocurrency ecosystem due to its apparent integration of governance compromise, time-delayed transaction mechanisms, and breached signer authorizations. Industry discussion surrounding the event emphasized vulnerabilities inherent in multisig governance structures and the likelihood that signers authenticated transactions without comprehensive understanding. Drift characterized the operation as highly sophisticated, noting evidence of extended planning spanning multiple weeks.
Collaborative Investigation Involves Multiple Entities
Drift confirmed it is collaborating with numerous security specialists to establish the root cause and monitor asset transfers. The team is additionally partnering with cross-chain bridges, trading platforms, and regulatory authorities to immobilize misappropriated funds wherever feasible. The protocol has requested that individuals possessing pertinent information reach out to hello@drift.trade as investigative efforts progress.
A comprehensive post-incident analysis has not yet been published, though the protocol promised a thorough examination will be released in upcoming days as further details emerge. The direct outreach to the four Ethereum wallets represents an escalation in recovery efforts, suggesting the team is now pursuing direct dialogue with parties controlling addresses suspected of holding misappropriated assets.
On-chain messaging has become an increasingly common tactic in cryptocurrency investigations when teams attempt to establish communication with wallet controllers without conventional contact information. In this instance, Drift expressed readiness to engage in dialogue and encouraged recipients to reply through Blockscan chat. The public disclosure of wallet addresses and transmission timestamps created a transparent record of these contact attempts.
