00

Drift lost $285M.9 days of warning.

The warning signs were onchain and public. No smart-contract bug was involved. The attacker collected pre-signed durable-nonce transactions from Security Council signers, waited, and used them to take admin. This replay is a backtest: Overwatch's current rules applied to the public record, reconstructed from incident reports. It is not a live catch.

Drift lost $285M in about twelve minutes, and no smart contract bug was needed. The attacker collected pre-signed transactions from two of five council signers and waited. Every step was public on Solana for nine days, and nobody was monitoring the controls. Overwatch monitors them.

Existing monitors serve protocol teams. Overwatch watches on behalf of depositors.

15 protocols. $8.38B in deposits.
Here is who holds the keys.

1changeable by ≤2 people with no delayof the top 15 Solana protocols
3multisigsWhat does this mean?A wallet that needs several people to approve a transaction, for example 3 of 5. Safer than one key, if enough different people must sign. with no timelockWhat does this mean?A mandatory waiting period between approving a change and it taking effect. It gives depositors time to withdraw if something bad is approved.$1.55B in deposits can be changed instantly
2timelocks under 24 hoursless than a day to react to a bad change
6with control we can't fully map yetunknown is not the same as safe

days of warning · backtest

0.0

until the drain

gradeC55/100

Fri, 20 Mar 2026 00:00:00 GMT

Baseline

Security Council: 2-of-5 Squads multisig, zero timelock (configuration reported at the time of the attack). Overwatch would already grade this red: two people can change everything instantly.

Use ← and → to step through the timeline.

Sources

Reconstructed data: the reports do not publish full signer or nonce addresses, so these use placeholders (signer-A…F). The pre-migration threshold and timelock were not published; the reports describe the council as 2-of-5 with no timelock at the time of the attack, so both councils are modelled that way. Dates follow BlockSec's timeline. Drift's current council (4-of-7, 1-hour timelock) is watched live on its protocol page.