$295M Hack: Drift Protocol’s Recovery Plan Unveils User Compensation Strategy

by

$295M Hack Fallout: Drift Protocol Rolls Out User Recovery Plan

Show AI Summary
Drift Protocol tracks $293 million in stolen ETH across a few wallets, limiting the attacker’s off-ramping success
Recovery efforts involve a token model, issuing claims on a recovery pool to affected users based on verified losses
The recovery pool is backed by $3.8 million in remaining protocol assets and multiple funding streams, subject to governance approvals

Drift Protocol has announced a plan to help users recover funds after a security breach on April 1st resulted in losses of $295 million. This announcement comes as the platform prepares to come back online.

A cyberattack, believed to be carried out by a group connected to North Korea according to cybersecurity firm Mandiant, caused the platform to temporarily stop all trading and lending. The team now says they are working to fix the issues, but getting all users their money back will require funding from several sources and official approvals.

We promised our community a plan to get back on track, and today we’re sharing it. This update details how users will be reimbursed and how we’re rebuilding the exchange.

— Drift (@DriftProtocol) May 5, 2026

Majority of stolen funds still traceable

As a crypto investor, I’m relieved to hear that most of the funds stolen from Drift are still traceable on the blockchain. It seems the attacker hasn’t been very successful in converting those stolen assets into cash or other forms of value outside of the crypto space.

Around 130,000 Ethereum (ETH), worth approximately $293 million, is being closely watched across a few different digital wallets. Some of these funds, moved through the Wormhole network, are currently delayed and won’t be accessible again until at least late July.

At the same time, transactions using stablecoins on Circle’s systems have been temporarily paused. Drift is cooperating with regulators to get permission to release these funds back into the system, but it’s unclear when that might happen.

Recovery token model to track user losses

The main part of this plan involves a “recovery token” given to each wallet impacted by the issue. Each token will be worth one dollar for every dollar of confirmed loss, calculated from user balances at the moment the system was stopped.

These tokens aren’t related to Drift’s main token; instead, they represent rights to funds set aside for recovery. Users can redeem them when enough money is available in this pool, but redeeming early means you’ll get less if the pool grows larger later on.

Recovery pool backed by multiple funding streams

The recovery fund is starting with about $3.8 million from existing resources, which will be converted to stablecoins to maintain its value. We expect it to grow thanks to revenue from the exchange, new investments, and a commitment from Tether of up to $127.5 million, depending on how well the platform performs. Other partners have also promised up to $20 million.

Drift explained that the pool will keep growing until it reaches $295.4 million – the total amount of losses. Once it does, holders of recovery tokens will be able to redeem them for their full worth.

Insurance fund and governance decisions pending

The insurance fund for the protocol, which held around $20 million before the recent attack, remains untouched. How this money will be used – whether it will be given to those who deposited funds or contribute to overall recovery efforts – will be determined by a vote of the community.

Before any changes are made to the recovery plan – like how assets are handled or how tokens work – those changes will be put to a vote by the community.

Why assets won’t be returned directly

Drift explained that it can’t simply give assets back to users right away because of how its system works. The platform pools funds for lending and borrowing, and sudden withdrawals could cause problems with its finances and overall stability.

The plan is to turn assets into stablecoins and use a recovery pool to pay off debts in order. This approach aims to fulfill obligations smoothly and prevent any further disruption to the system.

Ongoing recovery and bounty efforts

Recovery efforts are ongoing, aided by cybersecurity companies and collaborators. To encourage ethical hackers to help, a reward program has been created offering 10% of any recovered funds. This program is being run with the help of exchanges like Bybit.

As an analyst following Drift, I’m seeing a significant planned overhaul set for a relaunch in early 2026. They’re streamlining their product offerings and rebuilding their security from the ground up. This includes deploying new smart contracts with regularly updated keys, tightening security around multi-signature access, and removing any features that could potentially create vulnerabilities. The focus moving forward will be primarily on perpetual futures trading, which means some of their current products might be put on hold or discontinued altogether.

Using stablecoins will become easier, and USDT is likely to be the main currency used for backing transactions and completing payments.

Next steps

Drift hasn’t announced when withdrawals will resume or the recovery token will launch. They stated that timelines depend on community approval and how quickly funds can be recovered.

The current plan provides a clear roadmap for recovery, but getting all losses back depends on successfully carrying it out, receiving help from others, and how current legal and recovery work progresses.

Read More

2026-05-05 18:17