TL;DR:
Drift Protocol fell victim on April 1, 2026, to a sophisticated operation attributed to a North Korea-linked actor, as confirmed by forensic firm Mandiant. The exploit resulted in the loss of $295 million in user funds, prompting the team to immediately suspend all core protocol functions, including trading and lending operations, to contain the damage.
The majority of the stolen assets have been tracked. Approximately 130,259 ETH, equivalent to around $293 million, are concentrated in four Ethereum wallets that are being monitored and flagged across exchanges and other entities. Two transfers executed through Wormhole were held by the Wormhole Governor until late July, blocking approximately 59.37 WBTC and 557.90 WETH.
Additionally, three transfers through Circle’s CCTP protocol were successfully frozen, totaling approximately 3.36 million USDC. Authorities are working to obtain a seizure order that would allow those funds to be burned and reissued to the protocol.
Each affected wallet will receive a recovery token representing one dollar of verified loss and constituting a proportional claim on the recovery fund. This instrument is independent of the DRIFT governance token and is transferable as an SPL token on the Solana network.
Drift’s recovery fund will be sourced from three streams: a substantial portion of the exchange’s quarterly net revenues, a fund provided by Tether of up to $127.5 million contingent on the exchange’s prior performance, and up to $20 million additional from strategic partners. The protocol’s remaining assets, valued at approximately $3.8 million, will be converted to USDT as initial capital. Token redemption will open once the fund surpasses $5 million, though redeeming before the fund reaches parity implies forfeiting the right to the remaining balance.
Drift’s relaunch is scheduled for the second quarter of 2026. The exchange will focus on perpetual markets, with reinforced multisig architecture, timelocks for administrative operations, mandatory audits, and the complete elimination of the attack vector exploited on April 1. Tether will also provide a $20 million market-making facility to ensure liquidity from day one. Key decisions within the plan will be subject to a DAO vote prior to their final implementation.
