Drift trading platform loses roughly US$295 million; recovery claims open
Attackers seized control of Solana trading platform Drift and stole roughly US$295 million. Affected users can claim DFX recovery tokens, but launch payouts covered only about 1% of losses. Check official claim terms: redeeming ends future rights on those tokens.
If you lost funds, follow [Drift's official claims notice](https://www.drift.trade/updates/dfx-claim-and-redemptions) using the wallet that held your account on 1 April; claims close at 00:00 UTC on 1 January 2028. Read the terms and current payout before redeeming, because it permanently burns your DFX and ends future recovery rights attached to those tokens. If you did not hold assets on Drift, there is nothing to update.
What’s happening
Attackers took administrative control of Drift, a cryptocurrency trading platform on Solana, on 1 April. Chainalysis reported that they obtained legitimate administrators' signatures on transactions executable later, then used fake collateral to withdraw real assets. Its initial estimate was US$285 million; Drift subsequently reported losses of roughly US$295 million. Users whose deposited assets were stolen face an ongoing recovery process, while Insurance Fund deposits were unaffected and became withdrawable in July. Drift announced a security rebuild and later said Mandiant attributed the attack to North Korean group UNC6862. Recovery claims opened on 1 October for DFX tokens backed by a pool funded through platform revenue, partner support and recovered assets. Launch redemptions returned about 1% of verified losses. Frozen assets were awaiting clearance, and further laundering was reported on 20 October. As of 3 November, the reviewed updates do not establish full reimbursement.
- What
- Breach
- Affects
- Drift Protocol cryptocurrency trading platform on Solana, subsequently called Velocity
- Fixed in
- Nothing to patch
- Since
- 1 Apr 2026
- Closed
- 20 Oct 2026
Timeline
- Update
Cointelegraph reported Lookonchain's finding that a wallet linked to the theft moved approximately 25,700 ETH, then worth US$61 million, into Tornado Cash. Recovery remained ongoing.
- Update
Drift opened DFX recovery-token claims, allocating one token per verified USDT lost. The pool held about 3.1 million USDT, with launch redemptions paying approximately 0.0104 USDT per token; redeeming permanently burns the tokens.
- Update
According to The Block's account of a Drift Foundation update, approximately US$9.2 million in stolen assets had been frozen. Returning those assets to the recovery pool still required law enforcement clearance.
- Update
Drift updated its recovery statement to say Insurance Fund depositors could withdraw their assets. These deposits had been unaffected by the theft.
- Update
In its update titled 3 June, published on 4 June, Drift said Mandiant's independent investigation had attributed the attack to UNC6862, a North Korean threat group.
- Update
Drift reported approximately US$295 million in outstanding user losses and proposed recovery support of up to US$147.5 million from Tether and partners. It announced independent audits and tighter controls over administrative transactions before relaunch.
- Made publicNothing to patch
Attackers took administrative control of Drift using transactions signed in advance. Chainalysis estimated US$285 million was stolen after the attackers made the platform accept worthless collateral.
Sources
- Incident Recovery Update – April 16, 2026Drift · 16 Apr 2026
- Drift Recovery Update – June 3, 2026Drift · 4 June 2026
- DFX Claims and Redemptions are now openDrift · 1 Oct 2026
- The Drift Protocol Hack: How Privileged Access Led to a $285 Million LossChainalysis · 9 Apr 2026
- Drift opens exploit recovery claims with initial payouts of just over 1% of user lossesThe Block · 2 Oct 2026
- Drift exploiter sends $61M ETH to Tornado Cash, holds $194MCointelegraph · 20 Oct 2026