The Solana Foundation on April 7 launched STRIDE (Solana Trust, Resilience and Infrastructure for DeFi Enterprises) and the Solana Incident Response Network (SIRN), a two-pronged security architecture for the network's DeFi ecosystem. The initiative arrives five days after DPRK-linked attackers d...
"Every enterprise I've talked to asks if the security and infrastructure of blockchain is ready for their needs before anything else." — Allan Marshall, CEO, Upexi
The Solana Foundation on April 7 launched STRIDE (Solana Trust, Resilience and Infrastructure for DeFi Enterprises) and the Solana Incident Response Network (SIRN), a two-pronged security architecture for the network's DeFi ecosystem. The initiative arrives five days after DPRK-linked attackers drained $285 million from Drift Protocol in 12 minutes — the largest DeFi exploit of 2026 and the second-largest in Solana's history behind the $326 million Wormhole bridge hack in 2022.
STRIDE, administered by Asymmetric Research and funded by the Solana Foundation, applies continuous security evaluations across eight pillars to every DeFi protocol on the network. Protocols with more than $10 million in TVL that pass evaluation receive foundation-funded 24/7 threat monitoring; those above $100 million in TVL gain access to formal verification tooling. SIRN, a membership-based coalition of five founding security firms, provides coordinated incident response and threat intelligence sharing. The program is version 0.1. Its first public evaluation reports are pending.
The question STRIDE attempts to answer is whether a foundation-administered security framework can close the gap between DeFi's economic ambitions and its operational reality. Solana's DeFi TVL fell approximately 15% in the week following the Drift exploit — from roughly $6.5 billion to $5.5 billion. The Drift hack was not a smart-contract vulnerability. It was a social engineering operation. That distinction matters, because it exposes a class of risks that traditional audits do not cover.
On April 1, 2026, at approximately 16:05 UTC, attackers executed 31 rapid withdrawals from Drift Protocol — Solana's largest decentralized perpetual futures exchange — draining an estimated $285 million in user assets within roughly 12 minutes. The attack wiped out more than 50% of Drift's total value locked.
The operation, attributed by TRM Labs and Elliptic to UNC4736 (also known as AppleJeus or Citrine Sleet), a North Korean state-affiliated threat group, was not a smart-contract bug. It was a six-month intelligence operation:
As Chainalysis noted in its post-mortem: "As DeFi infrastructure grows more layered and operationally complex, incidents like this highlight that the greatest risks are no longer just in smart contracts, but in the systems, and people, that surround them."
The Drift exploit is the single largest DeFi hack of 2026 to date. For context, total DeFi protocol losses in Q1 2026 stood at $168 million across 34 incidents, according to DefiLlama — an 89% year-over-year decline from Q1 2025's $1.58 billion. The Drift hack alone nearly doubled the quarterly total in a single event.
STRIDE is structured as a continuous evaluation framework — not a one-time audit. Asymmetric Research, the security firm administering the program, conducts hands-on assessments against eight security pillars:
Findings are published in a public repository, giving users and investors direct visibility into each protocol's security posture. This transparency model is notable. Traditional audits produce reports that are frequently held privately or released selectively. STRIDE's public-by-default approach creates a continuous, externally verifiable security record.
Tier 1: $10M+ TVL — Protocols that pass the assessment receive 24/7 active threat monitoring at no cost, funded by Solana Foundation grants. Coverage is calibrated to each protocol's risk profile. Protocols receive alerts when suspicious activity is detected, enabling response before incidents escalate.
Tier 2: $100M+ TVL — In addition to monitoring, these protocols receive foundation-funded formal verification — mathematical proofs that check every possible smart contract execution path rather than sampling representative scenarios.
The program launched as version 0.1. Asymmetric Research described the framework as deliberately iterative, expecting it "to sharpen quickly as real assessments inform it." Protocols apply via a public form.
Asymmetric Research brings substantial ecosystem knowledge. The firm, led by CEO Jonathan Claudius (formerly CSO at Jump Crypto, Director of Security Assurance at Mozilla), is embedded in core Solana infrastructure including Wormhole, Pyth, Firedancer, and Jito.
The Solana Incident Response Network (SIRN) is a parallel, membership-based intelligence-sharing coalition. Five founding firms:
| Firm | Specialization | |------|---------------| | Asymmetric Research | Protocol-level security, infrastructure review | | OtterSec | Smart contract auditing | | Neodyme | Attack simulation, Riverguard tool | | Squads | Multisig and access control infrastructure | | ZeroShadow | Threat intelligence and asset tracing |
SIRN members share threat intelligence, coordinate responses to active incidents, and contribute to the STRIDE framework's evolution. Response prioritization is ordered by TVL and estimated incident impact. Foundation funding covers operational costs; protocols access threat intelligence at no direct charge.
SIRN formalizes what was previously ad hoc. During the Drift exploit, there was no centralized coordination mechanism for Solana DeFi security response. SIRN aims to eliminate the coordination lag.
Additionally, Solana already hosts several free builder security tools that STRIDE unifies under its umbrella: Hypernative for threat detection, Range Security for real-time monitoring, Neodyme's Riverguard for attack simulation, and Sec3 X-Ray for contract analysis.
DeFi security economics remain structurally misaligned. According to Chainalysis, cryptocurrency theft reached $3.4 billion in 2025 — with DPRK-linked actors alone responsible for $2.02 billion. In Q1 2026, DeFi protocol losses totaled $168 million across 34 hacks before the Drift incident, which added $285 million in a single event.
The smart contract audit market was valued at approximately $2.69 billion in 2025, up from $2.14 billion in 2024. Simple ERC-20 audits cost $8,000–$20,000; advanced cross-chain or DeFi audits run $75,000–$150,000+. Formal verification exceeds $200,000 per engagement.
The cost asymmetry is stark: audit budgets for an entire protocol are frequently dwarfed by the potential loss from a single exploit. Drift's $285 million loss exceeds the cost of hundreds of formal verifications. Immunefi reports over $162 million in active bug bounties across 330+ projects, with $110 million paid to whitehats since launch — meaningful, but still less than half the Drift loss alone.
STRIDE's economic model attempts to realign this by socializing security costs through foundation grants rather than requiring each protocol to independently fund monitoring and verification. This transfers the cost burden from individual protocols to the foundation's treasury, effectively making DeFi security a public good within the ecosystem.
STRIDE's provision of formal verification for $100M+ TVL protocols is significant but bounded. Formal verification uses mathematical proofs to check every possible execution path in a smart contract. It is the most rigorous form of code assurance available. Certora's Solana Prover, which operates at the SBF (Solana Binary Format) level, is one of the primary tools.
The limitations are practical:
The $100 million TVL threshold is pragmatic triage. According to DeFiLlama data, Solana's largest DeFi protocols by TVL include Kamino ($2.8 billion as of Q3 2025), Jupiter Lend ($1.65 billion), Jito ($1.2 billion+), and several others above $1 billion. These are the protocols whose failures would produce systemic contagion.
STRIDE addresses a real gap but does not solve the DeFi security problem in full.
Social engineering: The Drift exploit was fundamentally a human-factors attack. Attackers built trust over six months, compromised devices via a malicious TestFlight app and a VSCode/Cursor vulnerability, and manipulated multisig signers into pre-signing concealed authorizations. STRIDE's eight pillars include operational security and governance controls, but the efficacy of these assessments against patient, well-resourced state actors remains unproven.
Cross-chain risk: STRIDE evaluates Solana-native protocols. DeFi increasingly operates across chains, and many Solana protocols depend on bridges and cross-chain messaging layers whose security sits outside STRIDE's scope.
Incentive alignment: STRIDE is foundation-funded. The Solana Foundation's treasury is finite. If Solana's DeFi ecosystem continues to grow, the cost of monitoring and verifying every qualifying protocol will scale. The program has no published long-term funding model or sustainability mechanism.
Voluntary participation: Protocols apply via a Google Form. STRIDE is not mandatory. There is no on-chain enforcement mechanism requiring protocols to meet STRIDE standards before accepting user deposits.
STRIDE and SIRN represent the first attempt by a major L1 foundation to build ecosystem-wide, continuous security infrastructure that goes beyond code audits. The program's scope — spanning governance, operational security, oracle dependencies, and incident response coordination — reflects a post-Drift recognition that the threat surface in DeFi extends well beyond Solidity or Rust.
Whether it works depends on execution specifics that remain undefined: how rigorously the eight-pillar assessments are conducted, how quickly SIRN can actually mobilize during a live exploit, and whether the foundation can sustain funding as the eligible protocol set grows. STRIDE version 0.1 is a framework, not a solution.
The Drift hack cost Solana's DeFi ecosystem roughly $285 million in direct losses and an estimated $1 billion in TVL outflows. The economic case for STRIDE is straightforward: the cost of not having coordinated security infrastructure now exceeds the cost of building it. The harder question is whether any evaluation framework — however well-designed — can defend against attackers willing to spend six months and millions of dollars infiltrating a single target.