Drift Protocol Exploiter Sold SOL for ETH on HyperLiquid

Drift Protocol Exploit Record Leaves the HyperLiquid ETH Claim Unverified

Drift Protocol said it was observing unusual activity and told users not to deposit funds while it investigated, citing its own X account as the channel for updates: https://x.com/DriftProtocol/status/2039404931778535427. That protocol statement is the firmest fact in the current record, while the more specific claim that the exploiter moved SOL through HyperLiquid and into ETH is still not established by the sources in this brief.

In its April 1, 2026 update, Drift said it was observing unusual activity on the protocol, told users not to deposit funds, and said the incident was not an April Fools joke. That post is important because it is the only primary statement from Drift in the brief, and it does not describe a confirmed HyperLiquid leg or an ETH purchase.

What the sourced record shows

Lookonchain said more than $270 million in assets had been suspiciously transferred to wallet HkGz4KmoZ7Zmk7HN6ndJ31UJ1qZ2qgwQxgVqQwovpZES, and the cited Solana explorer page shows finalized activity for that address during the incident window. Together, those two links support a narrow on-chain claim: public trackers identified a wallet tied to the event, and that wallet was active on Solana.

$270M+

For readers who follow transaction-level verification, including March Bitcoin Update: Mempool Upgrades and BIP-360 Progress, the distinction here is straightforward: the Lookonchain post and the Solana explorer entry point to a flagged wallet, but neither source by itself proves a deposit into HyperLiquid or a SOL-for-ETH trade. That is why the headline allegation has to remain narrower than many early rewrites suggest.

Another verified response came from DeFi Development Corp’s April 1, 2026 statement, which said it had no exposure to the Drift Protocol exploit and that neither its SOL treasury nor its partnership with Drift was impacted. That release does not confirm anything about the exploit path itself, but it does narrow one part of the spillover story by showing that at least one public company moved quickly to say its balance sheet was unaffected.

What still needs proof

The missing evidence is the core issue. Drift’s protocol update confirms an incident, and the flagged wallet page confirms on-chain activity, but the brief does not include a HyperLiquid deposit address, account page, trade log, or transaction hash tying that wallet to an ETH buy. Until one of those direct records appears, the safer reading is that the exploit is confirmed, while the reported HyperLiquid route remains unverified.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.