JLaunchpad (JLP)

The Driff protocol hack isn’t as straightforward as it seems.

Let’s walk through what actually happened:
The attacker exploited the durable nonces feature to pre-sign transactions weeks in advance, tricking the Security Council (multisig) into approving them. This ultimately allowed the attacker to seize admin control, modify withdrawal limits, and drain several major vaults. Specifically:

1, Created a wallet and pre-signed transactions using durable nonces to deceive the multisig into approving them

2, Submitted two pre-signed transactions → taken over admin privileges

3, Drained more than 15 different tokens (JLP, SOL, USDC, etc.) within minutes (~$270–285M)

4, Converted assets into USDC

5, Bridged funds to Ethereum via Wormhole with Backpack also suspected to be involved in the laundering flow

6, Swapped a portion into ETH (~19,913 ETH ≈ $42.6M)

7, Funds were then routed through multiple addresses linked to potential laundering activity

Looking back at 2022, Driff also suffered from a logic flaw in