On April 1, 2026, attackers drained $285M from Drift Protocol in 12 minutes using social-engineered multisig approvals and zero timelock. Here's how other Solana protocols compare.
Multisig threshold + timelock configuration
A low multisig threshold without a timelock is a single point of failure. Drift's 2/5 configuration with zero delay meant two social-engineered signatures were enough to drain $285M instantly. Protocols with higher thresholds AND timelocks give the community a window to detect and respond to malicious transactions. If a protocol you use doesn't publish its multisig configuration — ask.