Recovery Plan for Affected Users

On April 1, 2026, Drift Protocol suffered a $295 million exploit orchestrated by a threat actor affiliated with North Korea (DPRK), as confirmed by forensic firm Mandiant. The attack forced an immediate suspension of all core protocol functions, including trading and borrowing. Over the past month, Drift has been working with law enforcement and partners to recover frozen funds and design a user recovery framework.

The majority of stolen assets remain traceable, with approximately 130,259 ETH (~$293 million) concentrated across four attacker-controlled Ethereum wallets, actively monitored and flagged. Two Wormhole bridge transfers (59.37 WBTC and 557.90 WETH) are locked until late July, and about 3.36 million USDC has been frozen via Circle’s CCTP. Legal proceedings are underway to obtain seizure warrants for the frozen stablecoins.

The recovery plan issues a Recovery Token to each affected wallet, representing $1 of verified loss (separate from the DRIFT governance token). The recovery pool will initially be seeded with remaining protocol assets, converted to stablecoin at an estimated $3.8 million notional value. The pool will grow through three capital streams: quarterly exchange revenue, a Tether matched deployment of up to $127.5 million, and up to $20 million from strategic partners. Redemption opens once the pool exceeds $5 million, with a one-time burn-on-redeem mechanic.

Drift aims to relaunch in Q2 2026 as a leaner, perps-native exchange focused on security. Changes include a formal OpSec policy, removal of durable-nonce attack surfaces, instruction-level audits, timelocks for multisig operations, and migration to USDT as the primary stablecoin. Markets will be narrowed to the most liquid pairs, with committed liquidity from leading market makers and Tether’s $20 million market-making facility. The team emphasized that user compensation flows are structured separately from trading liquidity.

A 10% bounty program on recovered assets has been launched in collaboration with Bybit and other partners. Key decisions, including the final recovery pool mechanics and multisig structure, will be subject to governance proposals and DAO votes.