Solana-based decentralized finance (DeFi) platform Drift warned users about an "active attack" on cloud based automated crypto trading system for portfolio rebalancingits platform Wednesday, saying it had suspended withdrawals and deposits.\n\n"We are coordinating with multiple security firms, bridges and exchanges to contain the incident," the account said.\n\nDrift had earlier said it was investigating “unusual activity” on its protocol, prompting concerns that the platform may have been exploited.\n\n“We are observing unusual activity on the protocol. We are currently investigating. Please do not deposit funds into the protocol while we investigate,” Drift wrote in a post on X . “This is not an April Fools joke. Proceed with caution until further notice. We’ll provide additional updates from this account.”\n\nThe warning triggered speculation across the crypto community, with some users reporting irregular behavior tied to their positions.\n\nHelius CEO Mert Mumtaz added to the concern in a separate X post , writing, “not 100% fully certain yet, but it seems drift might be getting exploited.” Helius is a key infrastructure provider on Solana, offering APIs and node services that developers and platforms rely on to access blockchain data.\n\nArkham data said over $250 million had moved from Drift to an interim wallet, before moving to various other addresses. Less than $600,000 was in the address as of press time.\n\nThe Drift (DRIFT) token's price fell over 20% in the hours after the exploit was first reported, trading at about $0.05 as of press time.\n\nIf confirmed, an exploit could affect user funds and add pressure on Solana’s DeFi ecosystem, which has seen renewed growth in recent months.\n\nSolana's (SOL) price fell over the past few hours but recovered a bit after hitting a localized bottom at $83.82, and is still up over 1% on the day's trading.\n\nUPDATE (April 1, 2026, 18:49 UTC): Adds additional detail.