Hackers have stolen $280 million from the unregulated crypto exchange Drift, representing roughly half of the total U.S. dollar value on deposit with the platform, according to the company. Drift, the largest perpetual futures exchange on the Solana blockchain, said the attack occurred Wednesday, in what it described as a highly coordinated operation involving multi-week planning and staged execution. The exchange has since frozen customer funds while investigators work to contain the fallout.
Perpetual futures, the contracts central to the breach, are derivatives with no expiration date that allow traders to speculate on asset prices using leverage. These contracts have surged in popularity over the past year, particularly in decentralized finance (DeFi), a lightly regulated segment of the cryptocurrency market. Drift’s vulnerability underscores the risks inherent in platforms offering high-leverage trades without the protections found on traditional exchanges.
“This was a highly sophisticated operation that appears to have involved multi-week preparation and staged execution,” Drift said in a series of posts on X on Thursday. The company warned users not to deposit funds while it investigates the incident, stressing that the breach is real and not a prank. Drift and the Solana Foundation have not responded to requests for additional comment.
The growth of perpetual trading has coincided with the rise of new exchanges such as Hyperliquid, which reported a 420 percent increase in derivative trading volumes to $2.93 trillion in 2025, according to DefiLlama. These platforms offer round-the-clock access to assets like oil and metals, providing retail traders with opportunities to trade even when traditional exchanges such as the CME and ICE are closed. Weekend trading, in particular, has increased following the Iran war, as market participants seek ways to hedge oil-related risk.
“Inevitably, people want to trade” on weekends, said Mike Cahill, chief executive of Douro Labs. “When you’re dealing with a smaller exchange that’s less well-capitalized, you’re taking a fair bit of risk. It’s as simple as that.”
The Drift attack employed sophisticated tactics to gain control of the protocol, including manipulating personnel with access to key wallets. The methods resemble a 2025 breach of Bybit, where North Korean hackers stole $1.5 billion in cryptocurrency. In total, North Korean hackers were responsible for $2.02 billion in crypto theft in 2025, a 50 percent increase from the previous year, according to Chainalysis.
Unlike Bybit, which was able to provide emergency loans to cover withdrawals, Drift’s smaller scale and limited capital base have forced it to freeze user funds entirely. The company emphasized that the attack was meticulously planned for weeks but executed within hours, exploiting gaps in internal controls and security protocols.
The incident comes as U.S. regulators prepare to approve perpetual futures for trading domestically. Michael Selig, the new chair of the U.S. derivatives regulator, has announced plans to provide authorization in the coming weeks. Analysts warn that the Drift hack demonstrates the significant risks traders face in unregulated or lightly regulated platforms, particularly when using leveraged products.
As perpetuals trading continues to expand globally, the Drift breach serves as a stark reminder of the cybersecurity vulnerabilities inherent in DeFi exchanges. With hundreds of millions of dollars at stake and users exposed to losses in a decentralized and minimally supervised environment, industry observers say stronger safeguards, insurance mechanisms, and regulatory oversight are critical to prevent future large-scale attacks.
The $280 million theft from Drift is one of the largest DeFi-related breaches in recent memory, highlighting both the opportunities and dangers in a market that has grown rapidly but remains largely unpoliced. For traders and investors, the episode underscores the need for caution, risk management, and scrutiny of the platforms that host high-leverage cryptocurrency products.
