Over $303M drained across 3 incidents in March 31 – April 5: a $285M governance hijack on Solana, an $18.2M social engineering theft laundered via THORChain, and a $72K automated wallet drain on TRON. Weekly incident breakdown by Recoveris.
This week’s Recoveris report covers the $285 million exploit of Drift Protocol on Solana through a governance hijack and fabricated collateral, an $18.2 million social engineering attack on a Kraken user with funds bridged via THORChain, and a $72,000 automated wallet drain demonstrating surveillance-and-strike tactics on TRON.
Drift Protocol – ~$285,000,000 | April 1 | DeFi Exploit
On April 1, an attacker drained approximately $285 million from Drift Protocol, the largest decentralized perpetual futures exchange on Solana, in roughly 12 minutes. The attack combined social engineering of multisig signers into pre-signing hidden authorizations with a zero-timelock Security Council migration that eliminated the protocol’s last line of defense. The attacker manufactured a fictitious token, CarbonVote Token, seeded it with a small amount of liquidity and wash trading, and exploited Drift’s oracle system into treating it as legitimate collateral worth hundreds of millions. Stolen assets were swapped to stablecoins and bridged to Ethereum within hours.
This is the largest DeFi exploit of 2026 and the second-largest in Solana’s history, behind only the $326 million Wormhole bridge hack in 2022. The vulnerability was not a smart contract bug but a governance architecture failure: the combination of social engineering, fabricated collateral, and the absence of meaningful time-delay safeguards on administrative actions. TRM Labs and Elliptic have both flagged the operation as likely linked to North Korean threat actors, consistent with the operational speed and laundering sophistication observed.
The scale and speed of fund movement make this a critical test case for cross-chain forensic response. With assets already on Ethereum and laundering in progress, the window for exchange-freeze coordination and stablecoin issuer engagement is narrowing. Recoveris’s cross-chain tracing capability is designed for exactly this scenario: matching the speed of automated bridging operations with rapid forensic intelligence that supports freeze requests across multiple jurisdictions simultaneously.
Sources: TRM Labs
Kraken User (Anonymous) – ~$18,200,000 | March 31 | Social Engineering
An anonymous Kraken user lost approximately $18.2 million in a social engineering attack flagged by blockchain investigator ZachXBT on March 31. The attacker gained access through tactics consistent with phishing or impersonation schemes rather than a technical flaw in the exchange itself. Fund movement began within 45 minutes of the compromise, with assets bridged from Ethereum to Bitcoin using THORChain, a decentralized cross-chain protocol that enables transfers without centralized intermediaries.
Social engineering has emerged as the dominant individual-targeting attack vector in 2026, displacing code exploits in terms of total value stolen from non-institutional targets. THORChain’s role as a bridging mechanism for stolen funds is now well-documented across multiple incidents. The protocol’s decentralized architecture means there is no entity to serve a freeze order to, which makes the initial response window before assets leave identifiable addresses the only viable intervention point.
The active movement of funds and the documented on-chain trail create a time-sensitive recovery scenario. Forensic tracing across Ethereum and Bitcoin networks, combined with exchange engagement at downstream deposit points, remains the primary recovery pathway for social engineering cases of this scale.
Sources: Bitcoin.com News
Targeted Wallet Drain – ~$72,000 | April 4 | Wallet Surveillance
Hackers monitoring a personal wallet on the TRON network executed a drain of approximately $72,000 within three minutes of a $43,000 deposit being made. The wallet already held $29,000 at the time of the deposit, and the attacker cleared the entire balance, including the remaining 60 TRX in transaction fees. The precision and speed of the extraction point to an automated script triggered by on-chain deposit activity.
While the dollar value is significantly lower than the other incidents in this report, this case is operationally significant. Surveillance-and-strike attacks represent a growing class of automated theft where attackers monitor known compromised or targeted addresses and execute pre-programmed drain scripts the moment funds arrive. The three-minute execution window leaves no realistic opportunity for manual intervention by the victim. These tactics are increasingly deployed at scale, with attackers monitoring hundreds or thousands of addresses simultaneously.
For individual victims, this type of incident highlights why immediate wallet migration after any suspected compromise is critical. Once an address is being monitored, any deposit becomes an extraction opportunity for the attacker. Recoveris’s forensic response for individual cases focuses on tracing the destination of drained funds and identifying exchange deposit points where assets can potentially be frozen.
Sources: CoinEdition
If your platform or users have been affected by recent exploits, immediate forensic intervention is critical to tracing and freezing assets before they reach obfuscation services.
