Fact-check findings

The reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.

1. #14[disputed][awaiting moderator]in section: Financial Losses and Scale

   “$270–$286 million drained from a single DeFi protocol in under one minute by exploiting pre-signed durable nonce transactions held by compromised multisig participants”

   reviewerThe Drift Protocol exploit drained $270-286 million from a single DeFi protocol in under one minute.The one-second/four-slot detail refers only to the admin-control takeover, not the full fund drain, which multiple Tier 1 sources put at roughly 12 minutes; conflating the two overstates the speed of the actual theft.
   Proposed correction (not yet applied)

   $270–$286 million drained from a single DeFi protocol over approximately twelve minutes (following a one-second admin takeover) by exploiting pre-signed durable nonce transactions held by compromised multisig participants
   citedwww.coindesk.com/tech/2026/04/02/how-a-s…llion-from-driftwww.trmlabs.com/resources/blog/north-kor…85-million-heist
2. #16[disputed][awaiting moderator]in section: Drift Protocol Exploit (April 2026) — Durable Nonce at Scale

   “including $155.6 million in JPL tokens, $60.4 million in USDC, $11.3 million in cbBTC”

   reviewer$155.6 million in JPL tokens was among the assets drained from Drift Protocol.The dollar figure is in the right range but the token is misnamed; JLP, not JPL, is the correct ticker used across CoinDesk, TRM Labs, and other reporting.
   Proposed correction (not yet applied)

   including $155.6 million in JLP tokens, $60.4 million in USDC, $11.3 million in cbBTC
   citedwww.trmlabs.com/resources/blog/north-kor…85-million-heist
3. #22[disputed][awaiting moderator]in section: Delivery Infrastructure and Distribution

   “20–25% for Rublevka Team affiliates”

   reviewerRublevka Team affiliates are paid on a 20-25% commission structure.Internal inconsistency: sections[2] correctly states Rublevka affiliates keep 75-80% of proceeds; this passage states 20-25%, which is the platform's own cut, not the affiliate commission.
   Proposed correction (not yet applied)

   75–80% for Rublevka Team affiliates
   citedwww.recordedfuture.com/research/rublevka…rainer-operation
4. #29[disputed][awaiting moderator]in the timeline

   “operating on a 10% commission model targeting 90+ wallet types.”

   reviewerRiddance WDaaS, which began operations on Solana in 2024 on a 10% commission model, targeted 90+ wallet types.This appears to conflate the Rublevka Team's documented '90+ wallet types' figure with Riddance, which is not corroborated by any source cited for Riddance.
   Proposed correction (not yet applied)

   operating on a 10% commission model.
   citedmedium.com/@sicher_height/part-4-tracing…ana-d184d0283e6a
5. #31[disputed][awaiting moderator]in the timeline

   “drain approximately $270–$286 million in under one minute”

   reviewerThe April 2026 Drift Protocol exploit drained approximately $270-286 million in under one minute.Same underlying conflation as the sections[3] finding: the admin takeover was near-instant, but the actual fund drain took roughly 12 minutes per Tier 1 reporting.
   Proposed correction (not yet applied)

   drain approximately $270–$286 million over approximately twelve minutes
   citedwww.coindesk.com/tech/2026/04/02/how-a-s…llion-from-drift

No source the reviewer could reach confirms or contradicts the claim.

1. #6[unverifiable][awaiting moderator]in section: Technical Attack Vectors

   “In Q1 2026, a Blink circulated on X (formerly Twitter) under the guise of an NFT free-mint; the Action endpoint returned a three-instruction transaction including an assign instruction. Wallets were drained within minutes of users clicking the link.”

   reviewerIn Q1 2026, a Blink circulated on X disguised as an NFT free-mint, whose Action endpoint returned a three-instruction transaction including an assign instruction, draining wallets within minutes.No inline citation is attached to this specific incident and no corroborating reporting was found; it may be a generic/illustrative composite rather than a documented event.
2. #10[unverifiable][awaiting moderator]in section: Named Threat Actors and Kit Ecosystems

   “with the largest single transaction exceeding $500,000”

   reviewerThe largest single Riddance transaction exceeded $500,000.Could not independently confirm this specific dollar figure; the source could not be fetched directly.
   citedmedium.com/@sicher_height/part-4-tracing…ana-d184d0283e6a
3. #24[unverifiable][awaiting moderator]in section: Delivery Infrastructure and Distribution

   “The Riddance kit routes laundered funds through a hub-and-spoke network of satellite addresses, with three primary satellite addresses identified by researchers holding approximately 95,751 SOL, 84,245 SOL, and 37,776 SOL respectively.”

   reviewerThe Riddance kit routes laundered funds through a hub-and-spoke network with three primary satellite addresses holding approximately 95,751, 84,245, and 37,776 SOL.Could not independently confirm these specific address balances; the source article could not be directly fetched.
   citedmedium.com/@sicher_height/part-4-tracing…ana-d184d0283e6a
4. #27[unverifiable][awaiting moderator]in section: Emerging Variants and Future Risk

   “The DEV Community article documenting assign-instruction and Blinks techniques notes the emergence of alleged 'agentic drainer' variants — AI-assisted drainer tooling capable of autonomously identifying targets, constructing delivery campaigns, and adapting prompts.”

   reviewer'Agentic drainer' variants -- AI-assisted drainer tooling capable of autonomously identifying targets and constructing campaigns -- are an emerging but unquantified threat.The page itself correctly flags this as low-confidence and unquantified by Tier 1/2 sources -- the self-hedging is accurate and appropriate.
   citeddev.to/ohmygod/anatomy-of-a-solana-walle…ks-phishing-50a8

The claim was accurate when written but events since have overtaken it.

1. #32[stale][awaiting moderator]in the timeline

   “the largest DeFi hack of 2026”

   reviewerThe April 2026 Drift Protocol exploit was the largest DeFi hack of 2026.Was accurate at the time of the Drift exploit but has since been superseded; the page's own research date (June 2026, per sections[8]) postdates the KelpDAO hack, so this claim is now stale.
   Proposed correction (not yet applied)

   the largest DeFi hack of 2026 at the time, later surpassed by the $292 million KelpDAO exploit on April 18, 2026
   citedwww.coindesk.com/tech/2026/04/02/how-a-s…llion-from-drift

A cited source no longer resolves or no longer says what the page attributes to it.

1. #13[link rot][awaiting moderator]in section: Financial Losses and Scale

   “https://www.mexc.com/en-NG/news”

   reviewerThe MEXC News article cited for the Kerberus $90M figure supports the claim.The primary AlexaBlockchain citation for this figure is fine; this secondary MEXC link does not support the claim and should be removed rather than relied upon.
   citedwww.mexc.com/en-NG/news

The cited evidence supports part of the claim but not all of it.

1. #30[partially supported][awaiting moderator]in the timeline

   “Advertisements for drainer kits claiming to bypass all transaction simulations appear in underground markets, with pricing up to 10 ETH (~$30,000) for premium scripts.”

   reviewerIn February 2024, advertisements for drainer kits claiming to bypass all transaction simulations appeared in underground markets, priced up to 10 ETH.The underlying source is accurately summarized in isolation, but its placement in a Solana-focused timeline without noting it concerns an Ethereum/MetaMask-targeted product overstates its relevance to the Solana drainer-kit narrative.
   citedcoinpaper.com/3392/wallet-drainer-promis…ailable-for-sale

The cited evidence supports the claim as written.

1. #1[confirmed][no action needed]in section: Overview and Classification

   “Named operators whose toolkits have been publicly attributed to this category include Rublevka Team (Recorded Future, February 2026), Riddance (attributed by on-chain researchers including AlanReports, 2024–2025), and earlier bitflip-capable kits Aqua and Vanish (Blowfish, February 2024).”

   reviewerRublevka Team, Riddance, and Aqua/Vanish are the named operators publicly attributed to this drainer-kit category, per the cited outlets and dates.All three attributions and dates check out against independently fetched/searched sources.
   citedwww.recordedfuture.com/research/rublevka…rainer-operationcryptodaily.co.uk/news-in-crypto/crypto-…bit-flip-attacks
2. #2[confirmed][no action needed]in section: Technical Attack Vectors

   “Solana's system program includes a built-in 'assign' instruction that changes the Owner field of any account the signer controls.”

   reviewerSolana's system 'assign' instruction changes the Owner field of any account the signer controls, unlike immutable Ethereum EOA ownership.Technical description matches SlowMist's original write-up.
   citedslowmist.medium.com/beware-of-solana-phi…red-708bbb30518e
3. #3[confirmed][no action needed]in section: Technical Attack Vectors

   “SlowMist documented a case in December 2025 in which a victim lost over $3 million through this mechanism, with an additional $2 million locked in DeFi protocols.”

   reviewerSlowMist documented a December 2025 case where a victim lost over $3 million to an assign-instruction attack, with an additional $2 million locked in DeFi protocols.Figures and date match SlowMist's alert exactly.
   citedslowmist.medium.com/beware-of-solana-phi…red-708bbb30518e
4. #4[confirmed][no action needed]in section: Technical Attack Vectors

   “Researchers at Blockaid documented this TOCTOU (time-of-check-time-of-use) pattern, in which the attacker modifies program state across a gap of as few as seven blocks between user signature and transaction execution.”

   reviewerBlockaid documented a TOCTOU pattern where attackers modify program state across a gap of as few as seven blocks between signature and execution.Exact numeric match to Blockaid's published example.
   citedwww.blockaid.io/blog/dissecting-toctou-a…ansaction-timing
5. #5[confirmed][no action needed]in section: Technical Attack Vectors

   “The Aqua and Vanish drainers (Blowfish, February 2024) pioneered a 'bitflip attack' variant: after obtaining a signed transaction, the drainer flips a conditional flag in the dApp's on-chain program so that a transaction simulated as sending SOL to the user instead drains their account on execution.”

   reviewerThe Aqua and Vanish drainers pioneered a bitflip-attack variant that flips a conditional flag after signature so a transaction simulated as sending SOL instead drains the account.Mechanism description matches Blowfish's original disclosure.
   citedcryptodaily.co.uk/news-in-crypto/crypto-…bit-flip-attacks
6. #7[confirmed][no action needed]in section: Named Threat Actors and Kit Ecosystems

   “The drainer supports over 90 Solana wallet types including Phantom, Solflare, Backpack, Coinbase, Bitget, OKX, and Metamask.”

   reviewerRublevka Team's drainer supports over 90 Solana wallet types including Phantom, Solflare, Backpack, Coinbase, Bitget, OKX, and Metamask.Matches Recorded Future's report.
   citedwww.recordedfuture.com/research/rublevka…rainer-operation
7. #8[confirmed][no action needed]in section: Named Threat Actors and Kit Ecosystems

   “Commission structure offers affiliates 75–80% of proceeds.”

   reviewerRublevka Team's commission structure offers affiliates 75-80% of proceeds.Confirmed accurate; note this directly conflicts with a different commission figure given for Rublevka later in sections[5] (see separate finding).
   citedwww.recordedfuture.com/research/rublevka…rainer-operation
8. #9[confirmed][no action needed]in section: Named Threat Actors and Kit Ecosystems

   “Researchers (AlanReports GitHub) identified the platform fee address as G8Zot3kvzPVriX4bwLkgM384jPUyiCUMvbd2VnofziNT and the operator address as riddyRAMQa5TQcdMbXvM3Eb8LPX4DTparuYuV6PXjAD. The kit operates on a 10% commission model and is attributed to approximately $8 million in total theft”

   reviewerRiddance's platform fee address is G8Zot3kvzPVriX4bwLkgM384jPUyiCUMvbd2VnofziNT and operator address is riddyRAMQa5TQcdMbXvM3Eb8LPX4DTparuYuV6PXjAD; the kit runs a 10% commission model attributed to approximately $8 million in total theft.Confirmed via search snippets of the cited Medium article; direct WebFetch of the article returned 403 so full-text cross-check was not possible.
   citedmedium.com/@sicher_height/part-4-tracing…ana-d184d0283e6a
9. #11[confirmed][no action needed]in section: Named Threat Actors and Kit Ecosystems

   “An ENS domain (riddances.eth) associated with the platform operator has been linked in external research to a $30 million Bitforex incident.”

   reviewerAn ENS domain (riddances.eth) associated with the Riddance operator has been linked in external research to a $30 million Bitforex incident.Confirmed via the Alan Peterson Medium article, which is not itself cited in the section's source list -- a citation gap worth noting.
   citedmedium.com/@sicher_height/part-4-tracing…ana-d184d0283e6a
10. #12[confirmed][no action needed]in section: Financial Losses and Scale

    “Security firm Kerberus, presenting findings at Solana Breakpoint, documented approximately $90 million in phishing-driven losses on Solana in H1 2025, representing approximately 15% of the $594 million in total cross-chain phishing and social engineering losses during that period.”

    reviewerKerberus documented approximately $90 million in phishing-driven losses on Solana in H1 2025, roughly 15% of $594 million in total cross-chain phishing/social-engineering losses.Figures confirmed via multiple independent search results.
    citedalexablockchain.com/solana-users-phished…-90m-in-h1-2025/
11. #15[confirmed][no action needed]in section: Financial Losses and Scale

    “Growing concerns over a Solana wallet-draining community of over 6,000 members were reported by Chainalysis in January 2024.”

    reviewerGrowing concerns over a Solana wallet-draining community of over 6,000 members were reported by Chainalysis in January 2024.Date and figure confirmed.
    citedcryptorank.io/news/feed/a48a0-growing-co…erns-over-solana
12. #17[confirmed][no action needed]in section: Drift Protocol Exploit (April 2026) — Durable Nonce at Scale

    “On March 23, 2026, attackers created four durable nonce accounts — two legitimate, two attacker-controlled.”

    reviewerOn March 23, 2026, attackers created four durable nonce accounts, two legitimate and two attacker-controlled, in preparation for the Drift exploit.Matches independent technical writeups.
    citedwww.coindesk.com/tech/2026/04/02/how-a-s…llion-from-drift
13. #18[confirmed][no action needed]in section: Drift Protocol Exploit (April 2026) — Durable Nonce at Scale

    “By March 27, following a Security Council member swap, new multisig approvals were obtained under the revised configuration.”

    reviewerFollowing a Security Council member swap around March 27, new multisig approvals were obtained under the revised configuration.Directionally and substantively accurate, slightly compressed (new approval confirmed by Mar 30 per BlockSec, not exactly Mar 27) but not misleading.
    citedwww.coindesk.com/tech/2026/04/02/how-a-s…llion-from-drift
14. #19[confirmed][no action needed]in section: Drift Protocol Exploit (April 2026) — Durable Nonce at Scale

    “On April 1, 2026 at 16:05:18 UTC, two pre-signed durable nonce transactions were submitted four blockchain slots apart. Within one second, admin control of the protocol was transferred to attacker-controlled addresses.”

    reviewerOn April 1, 2026 at 16:05:18 UTC, two pre-signed durable nonce transactions were submitted four blockchain slots apart, transferring admin control within one second.Precise timing detail confirmed by an independent technical postmortem.
    citedwww.coindesk.com/tech/2026/04/02/how-a-s…llion-from-drift
15. #20[confirmed][no action needed]in section: Drift Protocol Exploit (April 2026) — Durable Nonce at Scale

    “The attackers used a weaponized Visual Studio Code project ('tasks.json' with 'runOn: folderOpen') and a fraudulent wallet application distributed via Apple TestFlight to compromise contributor devices and obtain signatures for transactions that signers believed were routine.”

    reviewerAttackers used a weaponized VS Code project ('tasks.json' with 'runOn: folderOpen') and a fraudulent wallet app distributed via Apple TestFlight to compromise contributor devices.Both technical vectors independently confirmed.
    citedthehackernews.com/2026/04/285-million-dr…aced-to-six.html
16. #21[confirmed][no action needed]in section: Drift Protocol Exploit (April 2026) — Durable Nonce at Scale

    “Attribution to UNC4736 is supported by on-chain fund flows linking the operation to wallets used in the October 2024 Radiant Capital exploit ($53 million) and confirmed by Mandiant/Google forensic analysis.”

    reviewerAttribution to UNC4736 is supported by on-chain links to wallets used in the October 2024 Radiant Capital exploit ($53 million), confirmed by Mandiant/Google.Radiant Capital figure and Mandiant attribution independently confirmed.
    citedwww.elliptic.co/blog/drift-protocol-expl…rk-linked-attack
17. #23[confirmed][no action needed]in section: Delivery Infrastructure and Distribution

    “The Bonk.fun team reported the site was restored and affected users were refunded at 110%.”

    reviewerThe Bonk.fun team reported the site was restored and affected users were refunded at 110%.Confirmed via multiple independent outlets.
    citedwww.coindesk.com/tech/2026/03/12/bonk-fu…-drainer-planted
18. #25[confirmed][no action needed]in section: Defensive Gaps and Mitigation Landscape

    “Security firm Blockaid documented a mitigation approach called Lighthouse Protocol, which injects assertion instructions into transactions to verify that the final transaction state matches simulation expectations. However, researchers note that adding instructions can exceed Solana's transaction size limits, and the approach requires wallet integration.”

    reviewerBlockaid's Lighthouse Protocol injects assertion instructions to verify final transaction state matches simulation, but can exceed Solana's transaction size limits and requires wallet integration.Technical description and limitations confirmed.
    citedwww.blockaid.io/blog/dissecting-toctou-a…ansaction-timing
19. #26[confirmed][no action needed]in section: Defensive Gaps and Mitigation Landscape

    “Kerberus reported in late 2025 that only 13% of available Web3 security tools offer real-time transaction-level defenses against human-targeted attacks.”

    reviewerKerberus reported in late 2025 that only 13% of available Web3 security tools offer real-time transaction-level defenses against human-targeted attacks.Confirmed by the cited source's title and framing.
    citedmpost.io/only-13-of-web3-tools-offer-rea…to-solana-users/
20. #28[confirmed][no action needed]in section: Emerging Variants and Future Risk

    “The August 2025 incident in which an AI-generated malicious npm package drained Solana funds from over 1,500 developers before takedown (The Hacker News) illustrates that the attack surface extends to the Solana developer supply chain, not just end users.”

    reviewerAn AI-generated malicious npm package drained Solana funds from over 1,500 developers before takedown in August 2025.Minor imprecision: source describes 1,500+ downloads/installs rather than confirmed unique 'developers,' but this is a reasonable characterization.
    citedthehackernews.com/2025/08/ai-generated-m…npm-package.html