drift

The perpetual contract protocol Drift (now Velocity) Foundation has opened claims and redemptions for the security incident on April 1. Affected users can claim newly issued compensation tokens DFX at a rate of 1 DFX for every $1 of verified loss. DFX is a Solana standard SPL asset, with a fixed total supply of approximately 299.5 million tokens, corresponding to about $295.4 million in verified losses, and no further issuance will occur.Users can destroy DFX on the official portal and redeem it for USDT at the redemption price, or trade it on secondary markets like Raydium. The redemption price is determined by the balance of the recovery pool divided by the number of DFX tokens that have not yet been destroyed. Currently, there are about 3.11 million USDT in the pool, with a redemption price of approximately $0.0104, allowing for about $1 back for every $100 lost, covering about 1% of the losses, which has caused dissatisfaction in the community, believing there is a significant gap from the expected full compensation.The plan also includes a maximum support commitment of $127.5 million from Tether, up to $20 million from partners, as well as subsequent sources such as transaction fee sharing from the new trading platform Velocity and the recovery of stolen funds, most of which are upper limits or installment arrangements, and were not included in the pool on the opening day. After the DFX launch, the redemption price remains around $0.0104, while the secondary market trading price has risen from about $0.01 to approximately $0.03, with a 24-hour increase of about 210%, and liquidity at that time was around $200,000. The tokens can be freely transferred, and the trading price does not have to equal the redemption price; buyers are mainly concerned with subsequent funding, protocol revenue, recovered funds, as well as the impact of early redemptions and the destruction of unclaimed portions after the window closes on January 1, 2028.

According to Drift Foundation monitoring, DFX claims and redemptions are now online. Users who have verified losses from the April 1 incident can receive 1 DFX for every 1 USDT lost. Each DFX corresponds to a claim on the Recovery Pool, which currently contains approximately 3.11 million USDT. The funding sources include a portion of the daily net income from the Velocity protocol, up to 127.5 million USDT from Tether, up to 20 million USDT from strategic partners, and assets recovered subsequently.DFX can be redeemed for USDT based on the formula "Recovery Pool balance ÷ DFX outstanding supply." The redeemed DFX will be destroyed, and the transaction is irreversible. The claims window will close on January 1, 2028, at 00:00 UTC, at which point any unclaimed DFX will be destroyed. Yesterday, the Drift Foundation announced the progress of fund recovery from the April 1 security incident, revealing that approximately 295 million dollars of user assets were stolen. The foundation has engaged Mandiant, zeroShadow, and SEAL 911 to conduct investigations and fund tracking, with Mandiant identifying the attacker as the North Korean threat group UNC6862.

The Drift Foundation announced the progress of recovering funds from the security incident on April 1, where approximately $295.4 million in user assets were stolen. The foundation has hired Mandiant, zeroShadow, and SEAL 911 to conduct investigations and fund tracking, with Mandiant identifying the attackers as the North Korean threat organization UNC6862.The stolen funds were subsequently bridged to Ethereum, with approximately 130,259 ETH dispersed across four wallets. Of these, three wallets have not transferred any funds to date, holding a total of 107,165 ETH; the other wallet transferred about 23,094 ETH to Tornado Cash on July 23. The foundation stated that approximately $9.2 million of the stolen funds have been frozen, with the relevant funds previously transferred through Tornado Cash in August, but unfreezing and returning still require legal procedures.The Drift Foundation will transfer all assets recovered through freezing, bounties, or law enforcement to the DFX recovery pool and is assessing the subsequent path of the DRIFT token within the broader ecosystem. Additionally, the foundation has partnered with Bybit to launch a public bounty program, offering a 10% bounty for successfully recovered funds.

Cindy Leow, co-founder of the Solana perpetual contract exchange Drift (now Velocity), stated thatVelocity has completed audits with OtterSec and Asymmetric Research this week and is fully open-sourced, with the exchange restarting today.At the same time, as the exchange restarts and enters the next phase, she will step down. Previously, ChainCatcher reported on April 1 that Velocity was hacked by North Korean hackers due to a security vulnerability, resulting in a theft of $295 million.

According to on-chain analyst PeckShield (@PeckShieldAlert), the address marked as "Drift Exploiter" has deposited 23,095.1 ETH (approximately 44.4 million USD) into Tornado Cash for mixing, and has also transferred 0.85 ETH to Bybit.

According to Onchain Lens monitoring, after the Drift Protocol was attacked for $285 million on Solana in April, the attacker began to transfer funds through Tornado Cash after leaving the funds idle for 3 months.The attacker is quickly depositing ETH into the Tornado Cash Router in batches of 100 ETH, with multiple transfers occurring every minute.

According to official news, the stablecoin protocol Reflect, supported by a16z, announced the launch of an independent voluntary recovery plan for USDC+ position holders affected by the Drift (now Velocity) April hacking incident: a 180-day window is now open, during which holders can voluntarily sell their positions to Palindrome Engineering at a price of 0.2 USDC + 80 Reflect Credit (RC) per unit, with complete on-chain settlement.The plan is funded in advance by Palindrome and is completely independent of the Drift recovery process. Participation means waiving the right to pursue claims against Drift in exchange for immediate certainty of liquidity; those who do not participate can still support Drift's DFX recovery channel.

According to official news, the perpetual contract trading platform Drift announced today that it has officially changed its name to Velocity, stating that this brand upgrade aims to reflect the new generation trading platform architecture it is building.The team pointed out that in the perpetual contract market, execution speed and directional judgment are crucial. The name "Velocity" aims to embody trading speed and market momentum, while marking the platform's entry into a reboot phase.The official statement indicated that this renaming also represents a clear boundary in the product roadmap: the new platform will adopt a clearer system architecture, stronger security infrastructure, and a more defined product positioning. Currently, Velocity is advancing its reconstruction work and plans to open a private testing version to some partners and traders in the coming days to validate the stability and performance of the new generation Solana-based perpetual contract trading system.

According to official news, Pyra stated that after evaluating all feasible options, the company has decided to gradually shut down its operations. The official statement mentioned that the Drift vulnerability attack incident had a severe impact on its business and users. Despite continuously searching for a path to continue operations over the past few months, they ultimately failed to find a sustainable solution.

Drift Protocol stated that its current top priority is to restart the platform and restore revenue-generating capabilities to expedite the recovery process of user funds. After the platform restarts, it will become the largest USDT-based perpetual contract trading platform on Solana, and the related revenue will be used to support a specially established user compensation fund.Drift claims that substantial progress has been made in the restart efforts with strategic support from Tether and other partners. To enhance security, Drift announced the appointment of Noah Prince, the former head of engineering at Helium Protocol, as the protocol lead, responsible for protocol restructuring and security system upgrades.Meanwhile, former members of the Gauntlet team have also joined the restart efforts, providing risk management and treasury design support for the platform, including clearing engine reviews, funding rate optimization, market parameter adjustments, and ongoing risk monitoring. Additionally, Drift has hired the cybersecurity company Mandiant to conduct an independent forensic investigation of the attack incident.The investigation results indicate that this attack can be clearly attributed to the North Korean hacker group UNC6862, which is associated with multiple cyber attack operations. Drift stated that it will continue to prioritize security in advancing the platform restart and will announce the user compensation mechanism and specific timeline in the future.

Drift Protocol stated on platform X that after the protocol is restored online, users who have staked in the Insurance Fund will be able to withdraw their corresponding shares normally. The Insurance Fund is designed to maintain the protocol's solvency in the event of liquidation or bankruptcy. Since the protocol was paused before losses were completed through normal liquidation or bankruptcy processes, the Insurance Fund was not affected by the related vulnerabilities or attacks.Drift Protocol added that the assets of the protocol's own Insurance Fund will be used to support system restart and user recovery, and plans to publicly disclose the relevant on-chain addresses so that the community can track the use of funds and subsequent deployments.

The co-founder of the Solana ecosystem DeFi project Ranger Finance, cobra (@barrett_io), posted on the X platform that Ranger Finance is gradually shutting down. The project took on business beyond its sustainable capacity, and the founder invested personal funds to maintain operations, but delays in financing led to the accumulation of bills. Ultimately, the financing was unsuccessful, and the raised funds were returned.The team is trying to fairly pay employees and suppliers with the remaining two months of operating funds, but it is insufficient to cover all expenses. The treasury liquidation was unexpected and severely impacted budget decisions. Subsequently, the Drift attack incident depleted the remaining funds and personal capital. Treasury users affected by the Drift attack will receive recovery tokens when distributed by the Drift team. The founder stated that in hindsight, the project should have been shut down earlier and apologized for this.

According to CoinDesk, Drift Protocol has announced a user recovery plan for the approximately $295 million security breach on April 1, attributed to a North Korean-backed hacker group.The core of the recovery plan is to issue receipt tokens representing verified user losses, with each token representing $1 of verified loss, which holders can redeem based on the value of the recovery pool accumulated over time. The initial funding for the recovery pool is approximately $3.8 million, and it is expected to grow through exchange revenue of up to $127.5 million, Tether support, and up to $20 million from partners, until it covers the total loss of approximately $295.4 million.Drift has frozen about $3.36 million USDC and launched a public bounty to recover 10% of the assets. Drift plans to relaunch on a "security-first" exchange in the second quarter. Legal recovery efforts are still ongoing.

In less than three weeks, 12 agreements were stolen for over $606 million. Among them, the Drift incident resulted in a loss of $285 million, and Kelp DAO suffered a loss of $292 million, with the two attacks accounting for approximately 95% of the total losses.

North Korean hackers had months of offline contact and infiltration with employees of Drift Protocol before launching one of the largest social engineering attacks in the history of the cryptocurrency industry, resulting in a loss of approximately $285 million.Data from blockchain security company TRM Labs shows that North Korean hackers have accounted for 76% of all cryptocurrency hacking losses in 2026 to date.

UPBIT will terminate trading support for Drift (DRIFT) on June 1, 2026, at 15:00. The affected trading pairs include DRIFT/KRW, DRIFT/BTC, and DRIFT/USDT. Users must complete withdrawals before July 1, 2026; otherwise, deposit and withdrawal requests for the related assets will not be processed.

Minh Don, the product lead of Drift, stated on its official Discord that it will take a few weeks to optimize the codebase, remove and add some small but impactful features, and plans to relaunch its forked exchange in May or June this year.Previously, Drift Protocol suffered losses exceeding $285 million in an attack incident.

According to Cointelegraph, since the $280 million attack on Drift Protocol on April 1, at least 12 DeFi protocols and cryptocurrency companies have been attacked in just over two weeks.Since early April, attacks on crypto protocols or companies include CoW Swap, Hyperbridge, Bybit, Dango, Silo Finance, BSC TMM, Aethir, MONA, Zerion, and the recent Rhea Finance and Grinex exchanges.Among them, the DeFi protocol Rhea Finance reported that the attackers "exploited a vulnerability in Rhea's margin trading feature to execute a coordinated liquidity pool manipulation attack," affecting the Rhea Lend smart contract. According to blockchain security company CertiK, the stolen funds amount to approximately $7.6 million.

According to Cointelegraph, stablecoin issuer Circle is facing a class-action lawsuit in the U.S. District Court for the District of Massachusetts for failing to freeze the stolen funds from the Drift Protocol during the attack incident.The plaintiffs claim that the attacker transferred approximately $230 million USDC from Solana to Ethereum within hours using Circle's Cross-Chain Transfer Protocol (CCTP), and Circle did not intervene. The lawsuit accuses Circle of complicity and incitement to misappropriation and negligence. Crypto analytics firm Elliptic previously suspected that the attack may be related to North Korean-backed hackers, and the related funds were subsequently exchanged for ETH and transferred via Tornado Cash.

Drift announced on its official website that the Drift Protocol has received support from Tether and other partners, with Tether planning to invest $127.5 million and other partners planning to invest $20 million to jointly support user recovery.The support plan includes a $100 million revenue-linked credit line, ecosystem grants, and loans provided to market makers. Drift will establish a dedicated user recovery pool aimed at gradually addressing the $295 million in unpaid user losses as trading revenue grows. Additionally, Drift will issue independent recovery tokens to affected users, which represent a claim on the recovery pool and are transferable. Drift is currently working on the protocol restart, having hired Ottersec and Asymmetric for auditing, and will migrate the settlement layer from USDC to USDT. The previous attack resulted in approximately $295 million worth of assets being stolen, while the insurance fund assets were unaffected.