Drift Protocol Exploit: Reported $270M Sent to HkGz4K

Drift Protocol Exploit: What We Know About the Reported $270M Transfer

Drift Protocol said it was dealing with an active attack and halted deposits and withdrawals, leaving the key open question whether the reported transfer total tied to HkGz4K matches the on-chain record already visible to the public.

According to an unconfirmed report tied to the headline claim of $270M, assets were sent to HkGz4K, but the verifiable record currently supports a narrower sequence: Drift wrote on April 1, 2026 that it was experiencing an active attack and had suspended deposits and withdrawals.

Drift Protocol is experiencing an active attack. Deposits and withdrawals have been suspended. We are coordinating with multiple security firms, bridges, and exchanges to contain the incident. This is not an April Fools joke. We’ll provide additional updates from this account as… https://t.co/03SRPq4fHj

— Drift (@DriftProtocol) April 1, 2026

What Happened in the Reported Drift Protocol Exploit

The clearest primary evidence so far is Solana transaction data showing 41,721,062.002941 JLP moved into a token account owned by HkGz4K, which gives the story a traceable on-chain reference even though the full aggregate routed to that address is still unsettled.

41,721,062.002941 JLP

Decrypt identified that transfer as about 41 million JLP, worth roughly $155 million and reported that it moved out of a Drift vault, which is why early coverage centered on the wallet flow before a protocol postmortem existed.

Why the $270M Transfer Claim and HkGz4K Matter

The gap between the headline figure and the sourced record is the core reporting issue. A single source reported the $270M total, while the directly citable evidence currently consists of the 41,721,062.002941 JLP transfer and PeckShield’s broader $285 million initial loss estimate.

That distinction is why HkGz4K matters. The short identifier gives readers a concrete focal point for tracing the incident, but it does not by itself prove that every exploit-linked asset ended up at the same address or that the reported total has been fully reconciled.

PeckShield wrote that the initial estimated loss was $285 million, which widened the story beyond the first traced transfer and signaled that the damage assessment was still moving faster than public forensics.

The initial estimated loss of today's @DriftProtocol loss is $285m.

Here is the detailed breakdown: https://t.co/z3DjfN0NP1 pic.twitter.com/P84p2UVJZi

— PeckShieldAlert (@PeckShieldAlert) April 1, 2026

That is also why follow-on wallet narratives need to stay narrow. In Drift Protocol Exploiter Sold SOL for ETH on HyperLiquid, the reporting challenge was similar: later claims can be newsworthy, but they still need transaction-level proof before they should be treated as settled fact.

Immediate Implications for Drift Users and the Wider Crypto Market

For Drift users, the immediate confirmed implication is operational rather than forensic: deposits and withdrawals were halted in the official attack notice, so the next useful signals are reopening guidance, address tracing, and a postmortem that reconciles the 41,721,062.002941 JLP transfer with PeckShield’s $285 million estimate.

For the broader market, the incident matters because a publicly acknowledged attack plus a nine-figure security estimate is enough to reshape confidence even before root cause is known. Readers who care about verification standards in fast-moving crypto stories may recognize the same discipline from March Bitcoin Update: Mempool Upgrades and BIP-360 Progress: the most useful coverage separates what the chain shows, what security researchers estimate, and what remains unproven.

What to watch next is straightforward: more official updates from Drift, clearer aggregation of exploit-linked transfers into HkGz4K, and any postmortem that explains how the attack happened and whether the reported headline total survives fuller forensic review.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.