Undisclosed

The truth behind the Drift exploit

[ UNC-01 ]Security & Forensics

unverified / no proof

Independent Forensic Report & Attribution Proof

Details:

The team publicly claimed to have retained third-party cybersecurity firms to investigate the incident. To date, no official forensic report, confirmation of engagement, or technical evidence has been published.

Action Required:

Provide proof of active engagement with external security investigators.
Publish an unredacted forensic report detailing the technical vector of the exploit.

[ UNC-02 ]Multisig & Key Management

key anomaly

Pre-Exploit Multisig Migration & Signer Retention Anomaly

Details:

A multisig migration and Security Council update were executed 48 hours prior to the exploit without public rationale. One signer key from the previous council was retained in the new deployment and subsequently initiated the initial attack payload transaction.

Action Required:

Clarify the explicit purpose and justification for executing the multisig migration prior to the incident.
Disclose the complete list of authorized signers for both pre- and post-migration multisig setups.
Provide an official explanation for key retention across migration boundaries and address the signing entity of the initial exploit transaction.