
In brief
- Solana-based Drift Protocol was hacked on April 1, with $295 million in user funds drained by attackers linked to North Korea.
- Drift Protocol will issue recovery tokens to affected wallets, with each token representing $1 of verified loss.
- Tether committed up to $127.5 million in recovery funds, with strategic partners pledging an additional $20 million.
A month after North Korean-affiliated hackers drained $295 million in user funds from decentralized crypto exchange Drift Protocol, the Solana-based platform has released a detailed recovery plan outlining how it intends to compensate affected users and relaunch as a rebuilt, security-focused exchange.
The April 1 attack was attributed to a North Korea state-affiliated threat actor, as confirmed by forensic firm Mandiant. Following the exploit, Drift temporarily suspended all core protocol functions—including trading and borrowing—to prevent further unauthorized activity.
Approximately 130,259 ETH, worth roughly $293 million today, remains concentrated across four Ethereum wallets that are actively monitored and have been flagged across exchanges. Two additional transfers via the Wormhole bridge have been delayed by that protocol’s governor until late July, effectively locking funds in transit. Three stablecoin transfers have also been frozen by Circle, totaling $3.36 million worth of USDC.
To compensate victims, Drift plans to issue each affected wallet a “recovery token,” where each token represents $1 of verified loss. A recovery pool will be seeded with the protocol’s remaining assets—approximately $3.8 million converted to stablecoins—and will grow through quarterly exchange revenue along with up to $127.5 million committed by stablecoin issuer Tether and up to $20 million from additional strategic partners.
Users can begin redeeming their tokens once the recovery fund exceeds $5 million, though early redemption means forfeiting any future claims on the pool. The pool will keep growing until total inflows match the full $295,426,725.97 in exploit losses.
On the security front, Drift says it plans to deploy an entirely new program at a fresh address with fully rotated keys, implement timelocks on sensitive administrative operations, and remove the durable-nonce attack surface that was central to how the April 1 exploit was executed.
The team is targeting a relaunch in Q2 2026, refocused as a leaner, perps-native exchange, with leading market makers and a $20 million Tether market-making facility committed to providing liquidity from day one. A public bounty program—offering 10% of any successfully recovered assets—has also been launched in collaboration with crypto exchange Bybit.
“The Drift team is taking considered measures to ensure that users are made whole, and that Drift restores itself as the leading perpetuals DEX on Solana,” the exchange wrote. “The team has made internal hard decisions to restructure and operate as lean as possible, focusing entirely on recovery and relaunch. This will take time but the structure is in place, ecosystem partners are committed, and the work is underway.”
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
DeFi#Solana #Exchange #Drift #Plans #Repay #Users #Million #Crypto #Hack1778030275

