Solana-based Drift protocol has suffered an exploit, leading to at least $200 million in losses, according to onchain data. Some estimates place losses closer to $270 million. 

"We are observing unusual activity on the protocol. We are currently investigating," Drift wrote on X. "Please do not deposit funds into the protocol while we investigate. This is not an April Fools joke. Proceed with caution until further notice."

According to Rekt's leaderboard, the attack would rank as one of the largest onchain crypto hacks to date and potentially the largest Solana-based exploit outside of the $326 million Wormhole bridge exploit. 

The exploit, which started over two hours ago, seems to be targeting multiple Drift vaults, including JLP Delta Neutral, SOL Super Staking, and BTC Super Staking.

One large transfer of 41.7 million JLP tokens was worth about $155 million alone, though other assets, including SOL, USDC, cbBTC, and wBTC, were also drained, according to SolScan.

DRIFT is down nearly 5% to $0.064, according to The Block’s data.

Looksonchain found evidence that the exploiter has begun swapping the stolen assets into USDC using Jupiter, the Solana-based DEX aggregator, and is bridging those stablecoins onto Ethereum to buy ETH. As of 17:45 UTC, the attacker held 19,913 ETH, worth about $42 million.

Drift Protocol is a decentralized, open-source trading platform built on Solana. It is often considered to be a core part of the Solana ecosystem, particularly for perps trading, with total value locked above $550 million, according to DeFi Llama.

The main exploiter address (beginning HkGz4Kmo) appears to have been created eight days ago, when it began swapping on OKX and Jupiter DEXes. It then remained inactive until 18 hours ago, according to SolScan. 

Drift said it will provide additional updates from its official X account as it learns more.

This is a breaking story and may be updated.