Drift Protocol

Documented events with consequences still open. Each entry carries a source and a date.

1. Apr 1, 2026 Hack / funds theft Critical $296M ● open

   $295.7M exploit: vaults drained in 12 minutes via fake collateral and a controlled oracle, users still not repaid

   On 1 Apr 2026 Drift Protocol lost $295.7M of user funds in roughly 12 minutes across 31 withdrawals. Per TRM Labs' reconstruction the attack had been staged for weeks: from 11 Mar the infrastructure funds were withdrawn from Tornado Cash; between 23 and 30 Mar the attackers created Solana "durable nonce" accounts to pre-sign delayed transactions and socially engineered Security Council signers into approving hidden admin authorisations; on 27 Mar Drift had removed the Security Council timelock, erasing the detection window. In parallel they manufactured a fictitious asset (CVT, CarbonVote Token, minted 12 Mar with 750M units), pinned at about $1 via a small Raydium pool and wash trading and fed through an oracle they controlled: Drift's oracles accepted it as collateral worth hundreds of millions. On 1 Apr the pre-signed transactions deposited the fake collateral, raised withdrawal limits and drained the vaults; most of the proceeds were bridged to Ethereum within hours. Drift suspended deposits and withdrawals; the DRIFT token fell more than 40%. Forensics firm Mandiant attributed the attack to UNC6862, a North Korean threat group with direct ties to other state-sponsored actors (attribution reported by Drift itself in its official 3 Jun 2026 update). Recovery: Drift issued a dedicated recovery token (a transferable SPL token, separate from the DRIFT governance token), 1 unit = $1 of verified loss, against $295,426,725.97 in confirmed losses. The recovery pool started from the $3.8M left in the protocol and is meant to grow through quarterly exchange revenue plus announced commitments of up to $127.5M from Tether and up to $20M from other partners; redemption only opens once the pool exceeds $5M, and anyone redeeming early takes a pro-rata share of whatever the pool holds at that moment and forfeits the rest of their claim. The relaunch was made conditional on two independent audits (Ottersec and Asymmetric) and on a new community-governed multisig, with dedicated signing devices and timelocks on all critical administrative actions. On 1 Jul 2026 the protocol was rebranded Velocity and restarted as a perps-only exchange settled in USDT (no longer USDC), backed by a Tether credit line. As of the verification date users are NOT repaid: the latest official recovery update is the one dated 3 Jun 2026, which announces neither that the $5M threshold was reached nor that redemptions opened, deferring "detail on recovery mechanics and timing" to later communications.

   ↗ source

verified on Sep 3, 2026