A state-sponsored cyberattack nearly destroyed Drift Protocol. Now, with Mandiant's forensics, a new protocol lead, and Tether's backing — it's aiming for Solana's top spot.
Major Drift Protocol recovery update on June 3rd. The platform was hacked. User funds were lost. But now, there's a plan — and the people behind it have serious names attached. The story doesn't end with the attack. It's just getting started.
This wasn't a random hack. Mandiant — one of the world's top cybersecurity firms — ran a full independent investigation. Their conclusion was clear.
The attack came from UNC6862. That's a North Korean state-sponsored threat group. Mandiant tied them directly to other crypto platform attacks. Same tactics, same tools, same operational fingerprint.
North Korea has stolen billions from crypto in recent years. The protocol is now on that list. But unlike most victims, Drift is responding publicly — with forensic proof.
Source: Official X
Drift's recovery strategy is straightforward:
Relaunch the platform
Generate revenue.
Use that revenue to pay back affected users through a dedicated recovery pool.
The faster the platform performs, the faster users get their money back. That's the engine. No vague promises. No future token. Just a trading platform that earns its way back.
Tether company behind USDT, the world's most-used stablecoin — is providing strategic support. USDT is a dollar-pegged digital coin traders use to avoid crypto price swings. With Tether's backing, Drift will relaunch as a USDT-margined perpetual exchange on Solana. Every trade, every position — settled in stable dollars.
The target? Become the largest USDT perps exchange on the Solana ecosystem. Perps, short for perpetual futures, let traders bet on price movements without owning the actual asset.
The protocol didn't patch the old system. It brought in new engineers with real credentials. Noah Prince is joining as Head of Protocol. He was previously the Head of Protocol Engineering at Helium, where he led Helium's full migration to Solana end-to-end. His job at Drift is to strengthen the codebase and harden the platform's security architecture.
Former members of the Gauntlet team are also joining. Gauntlet specialises in financial risk modelling for DeFi protocols. Their scope covers the liquidation engine, funding rates, market parameters, liquidator optimisation, and ongoing risk monitoring. Together, Noah and the Gauntlet team will overhaul the code before anything goes live.
If the hack affected your funds, you're not forgotten. The recovery pool is built specifically to address outstanding user losses.
How fast it fills depends entirely on platform performance after relaunch. It has confirmed it will share more details — including exact timing and recovery mechanics — as they become available. No recovery has been processed yet as of June 4, 2026.
Drift protocol got hit by a North Korean state operation. That's serious. But the response — Mandiant forensics, Tether backing, top-tier engineers, and a dedicated recovery pool — is equally serious.
If the relaunch works, it becomes a Solana-dominant USDT perps exchange. Affected users get paid back through performance, not promises. The next update will include recovery timing. That's the one to watch.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before making any financial decisions in crypto markets. All details are sourced from Drift Protocol's official June 3, 2026 update and Wu Blockchain X, Mandiant's attributed findings. Ongoing developments may affect details reported here.
