Breaking: MLM Monitoring Flags Drift Protocol-Related Address With Approximately $27… Recorded

By Elena Petrova

Drift Protocol is dealing with a fast-moving on-chain incident, and early wallet-monitoring alerts around one related address still require careful attribution while investigators piece together the broader exploit trail.

According to unconfirmed MLM monitoring reports tied to an early $27… alert, a Drift Protocol-related address identified as HkGz4Kmo…pZES recorded notable activity before the story widened. What is directly verifiable so far is that a Drift Withdraw transaction recorded on April 1, 2026 at 16:17:53 UTC moved 477,375.415118 USDY into token account BuNUrRXPJn3rwGsPZ9KnrbaFsSKSjVqTmKCnuoAfhAkH, which the explorer shows is owned by HkGz4Kmo…pZES. Later reporting from The Block placed minimum losses at $200 million, suggesting the monitoring alert captured only an early slice of a much larger incident.

What MLM Monitoring Reported About the Drift Protocol-Related Address

Drift’s official X account said on April 1, 2026 that it was seeing unusual activity and told users not to deposit while the team investigated. The primary explorer evidence in the brief is transaction 4avaV9DShyfPCBwoYg3etBtQ32EE688HTJidByaUzDCCLCTN8WZGouekRiTCWTnHFRJm1ppgpFEzaB397kWgfe7x, which invoked Drift’s Withdraw instruction rather than providing a full public map of every affected vault.

The brief only supports describing HkGz4Kmo…pZES as a Drift Protocol-related address, not a wallet definitively controlled by the protocol itself, and the exact explorer transaction behind the early $27… monitoring figure has not been matched from public data. That distinction matters because a related-address alert can flag flow toward an endpoint without proving who initiated the transfer or how broad the user impact became.

Why the Alert Matters and What Readers Should Watch Next

Secondary reporting rapidly expanded the scope: at least $200 million was reported lost, some estimates approached $270 million, and one 41.7 million JLP transfer was valued at about $155 million, alongside reported drains in SOL, USDC, cbBTC, and wBTC. That gap between the verified 477,375.415118 USDY withdrawal and the much larger multi-vault estimates is why the safer framing is a developing exploit investigation, not a finalized accounting.

What matters next is whether Drift or outside investigators can connect the confirmed Withdraw transaction and the reported 41.7 million JLP transfer into a complete wallet map, identify destination wallets beyond BuNUrR…hAkH, and publish a postmortem that explains how the exploit moved across vaults. No official postmortem or root-cause analysis was available at filing time.

The fact that the clearest verified movement here is a USDY transfer also keeps stablecoin plumbing in focus, especially as policy questions around dollar-linked tokens remain unsettled in stories like Hong Kong’s First Stablecoin Licenses Delayed Beyond March Deadline. For market readers comparing very different forms of crypto capital flow, the contrast with Public Companies Added 47K BTC in March 2026 as Strategy Bought 44.4K is that Drift’s story is being driven by contested outflows rather than disclosed accumulation.

Readers following how public ledgers surface fast-moving crypto events may also recognize the broader infrastructure theme in March Blockchain Technology Update: Bitcoin Mempool Upgrades and BIP-360 Progress: transparent chains make alerts visible quickly, but labels and wallet relationships still need verification before the market can treat a monitoring post as settled fact.

For now, the most defensible reading is narrow: an official Drift warning, a directly verifiable USDY withdrawal into an HkGz4Kmo-owned token account, and outside reporting that points to a far larger exploit than the original monitoring alert suggested. Until Drift or investigators publish fuller wallet-level evidence, readers should treat new claims about the address as incremental updates rather than final conclusions.