{"id":"drift-platform-crypto-theft-apr-2026","category":"breach","status":"closed","title":"Drift trading platform loses roughly US$295 million; recovery claims open","tldr":"Attackers seized control of Solana trading platform Drift and stole roughly US$295 million. Affected users can claim DFX recovery tokens, but launch payouts covered only about 1% of losses. Check official claim terms: redeeming ends future rights on those tokens.","summary":"Attackers took administrative control of Drift, a cryptocurrency trading platform on Solana, on 1 April. Chainalysis reported that they obtained legitimate administrators' signatures on transactions executable later, then used fake collateral to withdraw real assets. Its initial estimate was US$285 million; Drift subsequently reported losses of roughly US$295 million. Users whose deposited assets were stolen face an ongoing recovery process, while Insurance Fund deposits were unaffected and became withdrawable in July. Drift announced a security rebuild and later said Mandiant attributed the attack to North Korean group UNC6862. Recovery claims opened on 1 October for DFX tokens backed by a pool funded through platform revenue, partner support and recovered assets. Launch redemptions returned about 1% of verified losses. Frozen assets were awaiting clearance, and further laundering was reported on 20 October. As of 3 November, the reviewed updates do not establish full reimbursement.","action":"If you lost funds, follow [Drift's official claims notice](https://www.drift.trade/updates/dfx-claim-and-redemptions) using the wallet that held your account on 1 April; claims close at 00:00 UTC on 1 January 2028. Read the terms and current payout before redeeming, because it permanently burns your DFX and ends future recovery rights attached to those tokens. If you did not hold assets on Drift, there is nothing to update.","product":"Drift Protocol cryptocurrency trading platform on Solana, subsequently called Velocity","audience":"both","severity":"critical","patch":"na","exploited":true,"cves":[],"tags":["drift","solana","crypto","crypto-theft","social-engineering","north-korea"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Incident Recovery Update – April 16, 2026","url":"https://www.drift.trade/updates/incident-recovery-update-april-16-2026-now","by":"Drift","date":"2026-04-16"},{"kind":"advisory","title":"Drift Recovery Update – June 3, 2026","url":"https://www.drift.trade/updates/drift-recovery-update-june-3-2026","by":"Drift","date":"2026-06-04"},{"kind":"advisory","title":"DFX Claims and Redemptions are now open","url":"https://www.drift.trade/updates/dfx-claim-and-redemptions","by":"Drift","date":"2026-10-01"},{"kind":"research","title":"The Drift Protocol Hack: How Privileged Access Led to a $285 Million Loss","url":"https://www.chainalysis.com/blog/lessons-from-the-drift-hack/","by":"Chainalysis","date":"2026-04-09"},{"kind":"news","title":"Drift opens exploit recovery claims with initial payouts of just over 1% of user losses","url":"https://www.theblock.co/news/ecosystems/2026-10-02-drift-opens-exploit-recovery-claims-initial-payouts-just-over-1-user-losses-417581","by":"The Block","date":"2026-10-02"},{"kind":"news","title":"Drift exploiter sends $61M ETH to Tornado Cash, holds $194M","url":"https://cointelegraph.com/news/drift-exploiter-eth-tornado-cash","by":"Cointelegraph","date":"2026-10-20"}],"started":"2026-04-01","closed":"2026-10-20","created":"2026-11-03T20:36:10.859Z","updated":"2026-11-03T20:36:10.859Z","cve_notes":[],"timeline":[{"at":"2026-10-20","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Cointelegraph reported Lookonchain's finding that a wallet linked to the theft moved approximately 25,700 ETH, then worth US$61 million, into Tornado Cash. Recovery remained ongoing.","url":"https://cointelegraph.com/news/drift-exploiter-eth-tornado-cash","by":"Cointelegraph","patch":null},{"at":"2026-10-01","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Drift opened DFX recovery-token claims, allocating one token per verified USDT lost. The pool held about 3.1 million USDT, with launch redemptions paying approximately 0.0104 USDT per token; redeeming permanently burns the tokens.","url":"https://www.drift.trade/updates/dfx-claim-and-redemptions","by":"Drift","patch":null},{"at":"2026-09-30","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"According to The Block's account of a Drift Foundation update, approximately US$9.2 million in stolen assets had been frozen. Returning those assets to the recovery pool still required law enforcement clearance.","url":"https://www.theblock.co/news/ecosystems/2026-10-02-drift-opens-exploit-recovery-claims-initial-payouts-just-over-1-user-losses-417581","by":"The Block","patch":null},{"at":"2026-07-07","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Drift updated its recovery statement to say Insurance Fund depositors could withdraw their assets. These deposits had been unaffected by the theft.","url":"https://www.drift.trade/updates/incident-recovery-update-april-16-2026-now","by":"Drift","patch":null},{"at":"2026-06-04","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"In its update titled 3 June, published on 4 June, Drift said Mandiant's independent investigation had attributed the attack to UNC6862, a North Korean threat group.","url":"https://www.drift.trade/updates/drift-recovery-update-june-3-2026","by":"Drift","patch":null},{"at":"2026-04-16","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Drift reported approximately US$295 million in outstanding user losses and proposed recovery support of up to US$147.5 million from Tether and partners. It announced independent audits and tighter controls over administrative transactions before relaunch.","url":"https://www.drift.trade/updates/incident-recovery-update-april-16-2026-now","by":"Drift","patch":null},{"at":"2026-04-01","added":"2026-11-03T20:32:12.437Z","kind":"disclosed","text":"Attackers took administrative control of Drift using transactions signed in advance. Chainalysis estimated US$285 million was stolen after the attackers made the platform accept worthless collateral.","url":"https://www.chainalysis.com/blog/lessons-from-the-drift-hack/","by":"Chainalysis","patch":"na"}],"url":"https://hard.fyi/live/drift-platform-crypto-theft-apr-2026/","json":"https://hard.fyi/api/live?id=drift-platform-crypto-theft-apr-2026"}