Solana rolls out “Crisis Mode” to counter DeFi threats

The Solana Foundation announced rolling out a fresh set of security initiatives. It aims at tightening how DeFi projects are monitored, tested, and defended. This comes just days after a $280 million exploit hit Solana-based Drift Protocol.

The hack turned out to be messy as attackers managed to gain control through a niche mechanism involving durable nonces. It led them to quickly take over administrative permissions. Hackers took advantage of a loophole that most users wouldn’t even know exists. However, analysts suggest that the pattern adopted by the attackers looks similar to previous attacks linked to North Korea.

Solana moves to 24/7 monitoring 

The foundation highlighted that it’ll now be leaning into something more continuous, real-time monitoring. It includes formal verification for larger protocols, and a coordinated response network that can step in when things break. The idea seems to be simple. Solana wants to stop treating security as a one-time checklist.

It is moving ahead with STRIDE (Solana Trust, Resilience, and Infrastructure for DeFi Enterprises) for security. The foundation explained it as a security program for all Solana DeFi. This will work with independent security evaluations. However, there will be public reporting of findings and tiered monitoring requirements based on total value locked (TVL).

A post mentioned that protocols managing over $10 million in TVL will get 24/7 threat monitoring. Those who exceed $100 million will qualify for formal verification funded by the Solana Foundation.

The foundation also launched the Solana Incident Response Network (SIRN). It is a dedicated network of security firms for real-time crisis response. The network aims to mobilize quickly during exploits. It turns out to be a power that has often been missing in past DeFi attacks, where response times proved critical.

The Solana ecosystem will also gain access to a suite of security tools at no cost. This includes threat detection infrastructure from Hypernative and real-time risk monitoring from Range Security. However, it also holds attack simulation via Riverguard by Neodyme, and static analysis tools from Sec3 and AuditWare.

Amid the hack, the Solana ecosystem had taken a hit to hover around $125 billion. SOL price has dropped by more than 4% over the last 7 days. It is trading at an average price of $80.03 at the press time.

XRP voices back Solana’s Security push

Around the same time, voices from the XRP side pointed out that this direction isn’t new. A validator known as Vet said Solana’s push lines up closely with what’s already being discussed between XRPL Foundation and RippleX. He mentioned recent conversations with RippleX engineers, including Ayo Akinyele, around what “next level” security actually looks like for XRPL.

Vet suggested that security upgrades can’t just happen inside one ecosystem anymore. If attackers are getting more coordinated, defenses probably need to follow the same path. He also hinted that some of the work already done on XRPL has started to show results.

DeFi needs to be safer across the ecosystem. Great to see Solana doubling down.

Their initiatives reflect the intuition of the @XRPLF and @RippleXDev collab on the next level of XRP security blog post last week.

We talked earlier this week with Ayo and Mayukha about the next… https://t.co/yGPVdn72tz

— Vet (@Vet_X0) April 6, 2026

The ongoing selling pressure has also led Ripple’s XRP to dip by around 4% over the past 30 days. XRP is trading at an average price of $1.31 at the press time. 

The urgency behind these measures became clear following the exploit of Drift Protocol. Blockchain analytics firm Elliptic noted that the attacks’ on-chain patterns remained closely the same. North Korean threat actors have been applying similar tactics. Chainalysis estimates that North Korea was responsible for around $2 billion in crypto theft in 2025 alone. This accounts for about 60% of global illicit crypto activity.

The fallout didn’t end with the exploit. Onchain Lens flagged a wallet tied to the Drift team moving over 56 million DRIFT tokens (approx worth $2.4 million) to CEX.

For a long time, DeFi security mostly meant audits before launch and patches after something went wrong. As of now, it looks more like traditional systems where there is constant monitoring, simulation of attacks, and teams actively trying to break things before attackers do.

There’s a middle ground between leaving money in the bank and rolling the dice in crypto. Start with this free video on decentralized finance.