Smart Contract Admin Keys Run on Borrowed Time

• Drift lost about $285 million on 1 April 2026 through pre-signed approvals from a 2-of-5 Security Council with no timelock.
• Radiant, Bybit and Drift each collected a valid threshold of signatures for a transaction the signers never meant to approve.
• Ronin’s 5-of-9 bridge fell to four keys held by one company plus a stale allowlist.
• Arbitrum’s Security Council moved 30,765.67 ETH away from the KelpDAO exploiter by upgrading an L1 contract to impersonate the exploiter’s address.
• Nexus Mutual’s protocol cover excludes phishing and malware that compromise privileged keys.

On 1 April 2026, two transactions landed on Solana four slots apart and handed Drift Protocol’s admin authority to an attacker. Both carried approvals from members of Drift’s Security Council, a Squads multisig that needed two of five signatures and ran with no timelock. The signers had approved the transactions in advance through durable nonces, a Solana feature that keeps a signed transaction valid until its nonce advances. With the admin role in hand, the attacker listed a token it had minted and wash-traded to about $1, then ran oracle manipulation through a price feed it controlled. It also lifted withdrawal limits and circuit breakers on the major markets. BlockSec’s reconstruction counts 31 withdrawals in about 12 minutes and a loss of roughly $285.3 million.

No line of Drift’s program failed, and each signature it checked came from a legitimate council key. Drift and SEAL 911 later linked the operation with medium-high confidence to the North Korea-linked group behind the October 2024 Radiant Capital theft. The approach took six months and began with people posing as a quant trading firm at a crypto conference.

A multisig threshold counts valid signatures from approved keys. Drift, Radiant and Bybit each collected a full threshold of valid signatures for a transaction the signers did not mean to approve, and in all three no delay sat between the final signature and execution. The control that changes that outcome is time. A timelock long enough for monitoring to flag a change, and for users to withdraw before it executes, turns a stolen approval into a public race that defenders can still win. Extra signers, hardware wallets and MPC all lower the odds of a bad approval. Only delay limits what one bad approval can do.

Buy bitcoin and stocks. Signup to Coinbase today

What a smart contract admin key controls

Admin authority sits wherever one approved call can change what a contract does. In EVM systems that covers an Ownableowner, an AccessControl role holder, the owner of a ProxyAdmin, whoever passes _authorizeUpgrade in a UUPS implementation, a beacon owner and a diamond’s cut authority. On Solana it is a program’s upgrade authority, which can redeploy the program until someone revokes it. Bridges add a verifier set, and rollups add the multisig or council that can upgrade the L1 contracts holding every bridged asset.

Diamonds carry the widest single power. ERC-2535 says diamondCut “allows arbitrary execution with access to the diamond’s storage” through delegatecall, and that access to it “must be restricted carefully.” Beanstalk was a diamond, and the proposal that drained it in April 2022 executed as a diamond cut.

The upgrade pattern and the authorization behind it need documenting separately. That authorization can be a single key, a Safe or Squads multisig, an MPC signer, a token vote, a timelock or a council. A UUPS proxy described as multisig-secured still leaves the threshold, the signer identities and the delay unstated, and those three facts set the risk.

Wasabi’s deployer wallet held admin authority over its PerpManager contracts on Ethereum, Base and Blast. On 30 April 2026 the compromised key signed an admin grant at 07:48 UTC, and the first vault drain followed about a minute later. On Ethereum and Base, a second grant let the attacker replace the WasabiLongPool implementation with code that swept the pool.

Admin key incidents from Parity to Drift

Chainalysis counted more than $3.4 billion stolen from January to early December 2025, with Bybit accounting for $1.5 billion and North Korean groups for at least $2.02 billion. Attacks on private key infrastructure and signing processes at centralized services made up 88% of losses in the first quarter of that year. In 2026, TRM Labs put Drift and KelpDAO together at 76% of all crypto hack losses through April.

Ronin and Harmony were key thefts. Radiant, Bybit and Drift left every private key with its owner and went after what the owner was shown or asked to sign. KelpDAO’s rsETH bridge ran a 1-of-1 verifier configuration with LayerZero Labs as the only DVN. The attacker compromised two RPC nodes that DVN relied on and knocked the others out with a DDoS, so the verifier failed over to the poisoned pair. LayerZero says it had recommended multiple verifiers and that its DVN instances were not breached.

Signing interface attacks at Radiant and Bybit

Radiant’s compromise started on 11 September 2024 with a Telegram message. A developer received what looked like a note from a former contractor about a smart contract auditing job, with a link to a zipped PDF, from a domain spoofing the contractor’s website. Radiant’s December update names the payload INLETDRIFT, a macOS backdoor that displayed a convincing PDF while it opened a channel to a remote domain. The file was shared on to other developers. Mandiant attributed the operation to UNC4736, a group it assesses with high confidence has a DPRK nexus.

Five weeks later the attackers used those machines. The initial post-mortem lists admin thresholds of 3 of 11 on Arbitrum and BSC, with signers on two Ledgers and a Trezor. The Safe front end displayed legitimate transaction data while malicious payloads went to the devices, and Tenderly simulations came back normal. Signers saw error messages asking them to resubmit, and each resubmission collected another signature. With three signatures the attackers transferred ownership of the LendingPoolAddressesProvider on Arbitrum, and the core markets on Arbitrum and BSC were drained on 16 October.

The future of finance is here. Trade crypto and more

The hardware wallets kept the keys off the infected laptops. They had no means of showing the signers a decoded payload, and with blind signing the devices approved data the signers could not read. Radiant’s remediation plan moved its admin and DAO multisigs to 4 of 7 on fresh devices, added calldata checks with the Etherscan input decoder, and put a 72-hour timelock on upgrades and ownership transfers.

Safe{Wallet} said the attack began with the compromise of a Safe developer’s laptop and the hijacking of AWS session tokens to get past multi-factor authentication. The attackers used that access to inject JavaScript into the Safe{Wallet} interface, set to activate only when both the Safe address and the signer address matched Bybit’s lists.

NCC Group’s analysis of the script shows what it changed. For a Bybit signer, it rewrote the transaction so to pointed at an attacker contract and operation was set to 1, a delegatecall. It then restored the original data before the proposal went back to Safe’s servers, so later signers saw the intended transfer in the interface. Their wallets showed raw EIP-712 data that differed from a routine transfer in a handful of fields. After three signatures, execTransaction delegatecalled the attacker contract, which wrote the attacker’s address into storage slot 0, where the Safe proxy keeps its implementation address. The cold wallet then ran attacker code, and 401,347 ETH left it on 21 February 2025. The FBI attributed the theft to North Korea’s TraderTraitor activity five days later.

Multisig thresholds and signer independence

Ronin’s bridge needed five of nine validator signatures, and four of the nine belonged to Sky Mavis. Ronin’s post-mortemexplains the fifth. In November 2021 the Axie DAO allowlisted Sky Mavis to sign on its behalf to help distribute free transactions, the arrangement ended in December, and the allowlist access stayed in place. One spear-phished employee and a backdoor through a gas-free RPC node gave the attacker all five signatures, and the theft went undetected for six days. The FBI attributed the attack to North Korea’s Lazarus Group, and the US Treasury sanctioned the address that received the funds.

Five of Ronin’s nine keys sat within reach of one company, and the attacker needed only that company plus a stale permission. A threshold measures independence only when each key lives with a different organization, device fleet and network. Harmony’s Horizon bridge was a 2-of-5 multisig, according to Polygon’s then security chief Mudit Gupta, and after the attack Harmony moved the Ethereum side to 4 of 5.

MPC moves that question off chain. Multichain’s node servers, by the company’s own account, ran on CEO Zhaojun’s personal cloud server, and only he had access. Chinese police detained him on 21 May 2023, more than $125 million left the bridge in July, and Multichain shut down.

Some programs now size thresholds to the money at risk. The Optimism Collective’s multisig security policy, published on 16 January 2025, sets default thresholds by risk band.

Critical signers use dedicated hardware wallets, never gather a majority of the threshold in one place, and rotate keys every two years. The Security Alliance’s multisig guidance recommends seven or more signers above $1 million in assets and, for high-value wallets, at least one required signer from outside the organization. Bypassing a timelock, in its framework, takes the standard quorum plus two. Drift lost $285 million through a council of 2 of 5. The Optimism default for any account that can do more than $10 million of damage is 7 of 9.

Token governance as an admin key at Beanstalk

Beanstalk’s emergencyCommit let a proposal execute at once if it had been live for a day and held more than two-thirds of Stalk, the protocol’s voting weight. On 16 April 2022 an attacker submitted BIP-18, a blank proposal, alongside a decoy BIP-19 offering $250,000 to a Ukraine donation wallet. A day later it flash-borrowed about $1 billion from Aave and routed it through Curve pools into Beanstalk’s Silo. DeFi Safety’s breakdown puts the resulting position at about 70% of all Stalk. emergencyCommit executed BIP-18 as a diamond cut, and the loan was repaid in the same transaction.

Buy bitcoin and stocks. Signup to Coinbase today

Beanstalk put the loss at about $77 million in non-Bean user assets. Voting power that can be borrowed for one block is a credential anyone can rent. The protocol removed on-chain governance after the attack and gave contract ownership to the Beanstalk Community Multisig, a 5-of-9 multisig of mostly anonymous community members and contributors that executes Stalkholder votes held on Snapshot. Its documentation describes the arrangement as temporary.

Voting power gets measured at a snapshot taken before the proposal exists, emergency paths carry higher quorums and their own delay, and any proposal that executes code passes through the same timelock as an upgrade.

Timelocks, exit windows and security council design

A timelock is worth the exit window it creates. If a malicious upgrade is queued for seven days, and users need two days to notice and one day to withdraw, four days of margin remain. If funds sit in locked positions, vesting contracts or a slow bridge, the same seven days protect the operator and leave users exposed.

Arbitrum writes the exit window into its governance. Its Security Council has 12 members, and non-emergency actions need 9 of 12 signatures and take effect after a delay of at least 18 days, which the DAO says lets users withdraw before execution. Emergency actions need the same 9 of 12 and can carry out any software upgrade with no delay. The Constitution limits them to a true security emergency and requires a transparency report once it has passed.

L2BEAT grades rollups on the same axis. Its Stages framework requires a Stage 1 security council of at least eight participants with a 75% threshold. Upgrades from anyone outside the council need an exit window of at least five days. Stage 2 asks for at least 30 days to exit unwanted upgrades, DAO-initiated ones included, and limits the council to intervening in adjudicable on-chain bugs.

Drift exposed the off-chain side of delay. BlockSec notes that a durable nonce decouples signing from execution and removes the expiry that would otherwise void a tricked approval. An ordinary Solana transaction lapses with its recent blockhash in roughly a minute. Nonce accounts tied to council members appeared on 23 March. A council migration on 27 March invalidated those signatures, and by 30 March a nonce account tied to a member of the new council existed. Approvals collected days in advance then met a council with no timelock to slow them.

Emergency powers after the Arbitrum freeze

On 21 April 2026, three days after the KelpDAO exploit, Arbitrum’s Security Council froze 30,765.67 ETH held by the exploiter on Arbitrum One. Its emergency action statement describes the method. In one atomic action the council upgraded Arbitrum’s Inbox contract on Ethereum to add a function called sendUnsignedTransactionOverride. It used that function to send a cross-chain transaction impersonating the exploiter, moved the ETH to an address ending in DA0, and restored the original Inbox. Releasing the funds needs a further action by Arbitrum governance.

The freeze took stolen money away from an attacker LayerZero links to North Korea. The same capability can send a transaction as any address on the chain. Between it and an ordinary user’s balance stand the 9-of-12 threshold the Constitution sets for emergency actions, the judgment of those members and a report written after the fact.

Protocols can build emergency powers narrower than that. A guardian limited to pausing deposits, borrowing or one bridge direction can contain a loss with no ability to move funds. Unpausing can require the full governance path, so a captured guardian can halt the system without redirecting it. Pauses can expire on a timer. Stablecoin freeze functions work at the narrowest level, one address at a time, and their reach is written into the token contract where anyone can read it.

The future of finance is here. Trade crypto and more

Admin key due diligence for listings, lenders and insurers

Regulators already read admin keys as control. IOSCO’s December 2023 DeFi recommendations list people with administrative rights to smart contracts among the responsible persons regulators should identify, describing them as able to alter the coding or operation of the contracts. Recommendation 5 asks regulators to establish that control, including through administrative rights to alter smart contracts. MiCA leaves out crypto-asset services provided in a fully decentralized manner without any intermediary, and the Regulation never defines the phrase. CMS reads write access to the contracts as a sign that at least part of a service falls short of that standard.

Insurers price the same line into exclusions. Nexus Mutual’s Drift incident report states that its Protocol Cover does not pay for operational security failures at the team level, such as social engineering, phishing or malware that compromises privileged keys. Its governance takeover clause requires exploitation of an on-chain governance mechanism, which did not happen at Drift. Drift had never been listed for cover, and Nexus received no claims for the event.

A due diligence file on admin keys records at least the following.

• Every privileged address, role, proxy admin, beacon owner, diamond cut authority, program upgrade authority and verifier set, traced to the signer set that ultimately controls it.
• Each capability on its own line, with upgrade, pause, mint, oracle, fee, role grant, timelock change and governance replacement listed separately.
• Threshold, signer count, signer organizations where public, custody technology, and the number of independent trust domains the keys occupy.
• Every delay, every path that bypasses it, and whether users can exit inside the delay.
• The signing pipeline, including the front end, RPC providers, simulation tools and whether a second decoder checks calldata before anyone signs.
• Whether privileged changes emit the Upgraded, BeaconUpgraded and AdminChanged events that ERC-1967 recommends, and who watches for them.
• The maximum value one approved transaction can move or corrupt.

A smart contract audit reviews code with the privileged roles assumed honest, and this file covers the ground that assumption leaves open.