TL;DR:
Drift Protocol released a formal update on the exploit suffered on April 1, detailing the recovery framework for affected users and the security measures planned for the platform’s relaunch.
The attack resulted in a total loss of $295.7 million in assets. JLP was the most affected asset, with nearly $159.4 million withdrawn, followed by USDC with $71.4 million and cbBTC with $11.3 million.

To compensate users, Drift designed a scheme funded primarily by Tether, which will contribute up to $127.5 million through a combination of revenue-linked credit facilities, an ecosystem grant, and loans to market makers. Other partners will contribute an additional $20 million.
A substantial portion of the exchange’s revenues, along with the committed support capital, will feed a dedicated pool that will gradually cover the $295 million in outstanding losses as the protocol regains activity. Funds recovered through collaboration with authorities and blockchain analytics firms will also be directed into that pool.
As a distribution mechanism, Drift will issue a recovery token independent of the DRIFT governance token, transferable and representative of a proportional claim on the pool. Details of its mechanics will be communicated shortly.

The relaunch is contingent on the completion of two independent audits. Ottersec will work on restructuring the codebase to incorporate security best practices. Asymmetric will advise on operational security, specifically addressing the vulnerability exploited on April 1, and will assist with improvements at the organizational level.
The new security scheme for Drift includes a community-governed multisig with participation from Solana ecosystem leaders, dedicated signing devices, independent transaction verification outside the signing interface, timelocks on critical administrative actions, and real-time alerts. Additionally, the protocol will migrate from USDC to USDT as its settlement layer, with market-making support provided by Tether from day one.
The protocol’s Insurance Fund remains intact and will be available to its depositors at the time of relaunch.