A fresh wallet is buying $20m worth of $jlp
Wallet: C7fQngbhbknNt84PQpCzJV7LJsgVYBEM2xSXMwSJnCEV https://t.co/zZZev0hZnV
A fresh wallet is buying $20m worth of $jlp
Wallet: C7fQngbhbknNt84PQpCzJV7LJsgVYBEM2xSXMwSJnCEV https://t.co/zZZev0hZnV
A fresh wallet is buying $20m of $jlp
Wallet: C7fQngbhbknNt84PQpCzJV7LJsgVYBEM2xSXMwSJnCEV https://t.co/I7bxzrtKPn
Whoah. DeFi is hard. But MultisigFi is harder https://t.co/Le3lu5wGpM
The Driff protocol hack isn’t as straightforward as it seems.
Let’s walk through what actually happened:
The attacker exploited the durable nonces feature to pre-sign transactions weeks in advance, tricking the Security Council (multisig) into approving them. This ultimately allowed the attacker to seize admin control, modify withdrawal limits, and drain several major vaults. Specifically:
1, Created a wallet and pre-signed transactions using durable nonces to deceive the multisig into approving them
2, Submitted two pre-signed transactions → taken over admin privileges
3, Drained more than 15 different tokens (JLP, SOL, USDC, etc.) within minutes (~$270–285M)
4, Converted assets into USDC
5, Bridged funds to Ethereum via Wormhole with Backpack also suspected to be involved in the laundering flow
6, Swapped a portion into ETH (~19,913 ETH ≈ $42.6M)
7, Funds were then routed through multiple addresses linked to potential laundering activity
Looking back at 2022, Driff also suffered from a logic flaw in