Tokenzz

NFT Collector and DeFi investor.

#cryptoart #DeFi #NFT #NFTart #digitalart

[Tokenzz @Tokenzz2]

@OmegaClickOffi1 su X gira voce che in una delle prossime release c’è un video girato da un bombardiere b2 approcciato da un disco così da vicino, da vedere addirittura la sagoma di un essere dentro.

[Tokenzz @Tokenzz2]

@NolideTheo @DriftProtocol years but never is more realistic

[Tokenzz @Tokenzz2]

@MrESTINZIONE pizza cotto e ananas è ok

[Tokenzz @Tokenzz2]

@DodgeStuar56932 @RealDonKeith 😅 what?! we are just a farm of engineered meat containers of essences.. we are the lowest point of cosmic food pyramid.

[Tokenzz @Tokenzz2]

@admpubmx @JorgeArteagaG @LeonBenLarregui Lazar 1 - 0…

[Tokenzz @Tokenzz2]

@MasterNotesX dipende da che distanza la si guarda.. una tv da 100 pollici si apprezza da almeno 3 o 4 metri.

[Tokenzz @Tokenzz2]

@paoloardoino Paolo!! Odio dirlo ma ci vogliono altri 120-130 milioni per Drift ☹️.. a me hanno creato un danno bestiale. Se non mi salvi tu non mi salva nessuno

[Tokenzz @Tokenzz2]

@GamewithDave RISE OF THE TRIAD

[Tokenzz @Tokenzz2]

@SolanaFloor @DriftProtocol @circle let’s recover another 30-40M for the users! GO GOGOGOGO

[Tokenzz @Tokenzz2]

@crypto_gateway SAN PAOLO DA GENOVA!! c’ho lasciato 22k alla causa nord coreana a questo giro.

[Tokenzz @Tokenzz2]

@JeSuisNaga @DriftProtocol @tether @circle +20 from other firms.. 133M missing

[Tokenzz @Tokenzz2]

@paoloardoino SAN PAOLO DA GENOVA.. PREGA PER NOI!

[Tokenzz @Tokenzz2]

@tether @SolanaFndn @DriftProtocol SAN PAOLO DA GENOVA PREGA PER NOI!

[Tokenzz @Tokenzz2]

@SolanaFloor @solana @solana should partecipate actively in the refound of the users..

[Tokenzz @Tokenzz2]

@bestplayeratlas gents DeFi is dead.

[Tokenzz @Tokenzz2]

@SolanaFloor We need it also for Drift hack……….

[Tokenzz @Tokenzz2]

@DriftProtocol I was hit really hard. Please try to find a way to reimburse the losses. The situation is quite critical for me

[Tokenzz @Tokenzz2]

@jovkodean @DriftProtocol @jump_ cost me 22k 😔

[DBCrypto @DBCrypt0]

Drift Protocol just released their thread on the $280 million hack

It's worse than anyone thought too

There was no code exploit. It wasn’t a flash loan. It wasn’t even a traditional key theft.

Solana has a feature called "durable nonces" that lets you sign a transaction today but execute it days or weeks later

Sound familiar EVM critics? 😏

Think of it like writing a signed check and leaving it in someone's drawer until they decide to cash it.

The attacker used this to build a time bomb inside Drift's own governance system.

So I was wrong and Solana’s architecture did in fact play a role in this exploit occurring. Similar to how a hacker exploits approvals on EVM chains.

Here's how it played out:

March 23: The attacker sets up four of these delayed-execution accounts. Two are tied to real Drift Security Council members and two belong to the attacker.

At some point, the attacker tricks two of Drift's five council members into signing transactions they didn't fully understand.

Blind signing is something I have called out a lot and it is a major issue with many of these chains

Drift calls it "transaction misrepresentation” 🤨

But in reality they were socially engineered into signing their own robbery

Those signatures sat dormant for nine days!

March 27: Drift rotates its security council. New members, fresh setup. Doesn't matter. The attacker compromises two of the five new signers too.

April 1: Drift runs a routine test transaction. Sixty seconds later, the attacker cashes those pre-signed checks. Two transactions, four Solana slots apart. Full admin control.

Every withdrawal limit removed. Every vault drained.

$280 million. Gone.

Two out of five signatures is all it took 🤦‍♂️

But also clearly some major planning and patience for this elaborate attack

Blind signing
Durable nonces which function similarly to approvals
Poor key management
Insecure infrastructure

Everything worked as it was designed to work and this was just an incredibly well orchestrated and thought out attack

[Tokenzz @Tokenzz2]

@ArxsTV so the hack was on spot vaults.. are the money from perp accounts involved?