Drift announces a $295 million hacker incident recovery plan, compensating attacked wallets based on losses

According to an official announcement published by Drift Protocol on X on May 6, Drift Protocol has officially launched a user recovery plan for the April 1 hack: each affected wallet will receive “Recovery Tokens,” with each token corresponding to 1 US dollar of the verified loss, as a proportional claim certificate for the recovery pool.

Recovery Token Mechanism and Redemption Rules

(Source: Drift Protocol official website)

According to Drift Protocol’s official announcement, Recovery Tokens are transferable SPL tokens and are independent of the DRIFT governance tokens; the redemption rules are as follows:

Open threshold: When the recovery pool funds exceed $5 million, the redemption channel opens

Redemption formula: Redemption price = total value of the recovery fund ÷ total amount of unredeemed Recovery Tokens

Early redemption terms: Users can redeem at any time, but early redemption means forfeiting the remaining claim rights to the recovery pool. Tokens not claimed after the claim window closes will be destroyed

Cap target: Once the recovery pool reaches the full amount of the loss, all unredeemed tokens can be redeemed at par value or a higher price

According to Drift Protocol’s official announcement, the insurance fund was not affected by this attack. Before the attack, the nominal value was about $20 million; its fund usage must be decided via a governance proposal and DAO voting.

Sources of Recovery Pool Funds

According to Drift Protocol’s official announcement, the recovery pool is continuously funded by three sources: most of each quarter’s net revenue from exchanges (directly injected in USDT terms); Tether’s matching deployment of up to $127.5 million (calculated proportionally based on the previous quarter’s exchange revenue); and up to $20 million committed by strategic partnership partners.

Status of Stolen Assets and Legal Proceedings

According to Drift Protocol’s official announcement, most of the stolen assets from the April 1 attack remain traceable and have been frozen:

· Four Ethereum wallets controlled by the attacker hold about 130,259 ETH (about $293 million), and have been flagged across exchanges and relevant parties

· The Wormhole administrator has delayed two bridged transfers (59.37 WBTC and 557.90 WETH) to late July

· Circle CCTP has frozen three transfers, totaling about $3.36 million USDC. Drift is working with law enforcement to obtain seizure warrants

According to Drift Protocol’s announcement, the forensics firm Mandiant has confirmed that the attack was carried out by a North Korea–linked threat group. Legal proceedings are ongoing, and there is currently no confirmed timeline for recovery. Drift plans to relaunch in Q2 2026 using a brand-new process, new addresses, and rotated keys, focusing on perpetual contracts and selected markets, with all major decisions subject to DAO voting.

FAQ

How do users claim and redeem Drift Protocol Recovery Tokens?

According to Drift Protocol’s official announcement, wallets affected by the April 1 attack can claim Recovery Tokens when the claim window is open. Redemption is available once the recovery pool exceeds $5 million. The redemption price is the recovery pool’s total value divided by the total amount of unredeemed tokens. Early redemption forfeits the remaining claim rights.

Why did Tether make commitments in the recovery plan?

According to Drift Protocol’s official announcement, Tether has committed up to $127.5 million to support the protocol restart and user recovery, and the matching deployment amount is calculated proportionally based on the exchanges’ net revenue from the prior quarter.

Who confirmed the April 1 attack? What is the status of the stolen assets?

According to Drift Protocol’s announcement and Mandiant’s confirmation, this attack was carried out by a North Korea–linked threat group. Most assets remain tracked or frozen, including about $293 million worth of ETH and funds frozen via Wormhole and Circle CCTP. Legal proceedings are ongoing.