Drift adjusted the multi-signature mechanism one week before the theft attack and did not set a timelock.

Golden Finance reported that on April 2, Cosine posted an analysis of the Drift theft incident. It pointed out that one week before the attack, Drift adjusted its multisig mechanism to “2/5” (1 old signer + 4 new signers) and did not set a timelock. The attacker then obtained administrator privileges, forged CVT tokens, manipulated the oracle, disabled security mechanisms, and transferred high-value assets out of the treasury pool.