The Drift Protocol Hack: What Happened to the $295 Million, and Why Victims Are Only Getting Pennies Back

On April 1, 2026, attackers drained roughly $295 million from Drift Protocol, a decentralized perpetuals and lending platform on Solana, in under 12 minutes — using a fake collateral token, a price oracle they controlled, and multisig approvals obtained through months of social engineering. Six months later, the money is still mostly gone: Drift’s recovery program, which opened October 1, 2026, is paying out only about 1 cent per dollar of verified loss, and on October 20, 2026, wallets tied to the attack moved another $61-63 million into the Ethereum mixing service Tornado Cash.

What actually happened on April 1

Drift Protocol let users borrow against collateral they deposited, with prices for that collateral tracked by price oracles and approved by a five-person multisig called the Security Council. The attackers exploited both pieces at once.

First, weeks in advance, they created a token called CarbonVote Token (CVT), seeded a small liquidity pool for it on the Solana exchange Raydium, and wash-traded it — buying and selling it among their own wallets — to pin its apparent market price at around $1, according to reporting from Unchained Crypto and Merkle Science. At the same time, they deployed their own price oracle that fed that artificial $1 valuation back to Drift.

Second, they needed Drift’s own systems to accept CVT as legitimate collateral. Rather than finding a bug in Drift’s code, they got there through people: starting in fall 2025, individuals posing as a quantitative trading firm approached Drift contributors in person at multiple crypto industry conferences, and malware later compromised at least two contributors’ devices, per Drift’s own account of the incident. That groundwork let the attackers obtain pre-signed approvals from two of the Security Council’s five members, using a Solana feature called durable nonces that lets a signed transaction sit dormant for weeks before being executed on command.

When the attackers finally pulled the trigger, those stolen approvals let them add CVT as approved collateral with an effectively infinite borrowing limit against Drift’s real vaults. They then borrowed out the protocol’s actual assets — USDC, wrapped SOL, and other tokens — against collateral that was worthless outside the price they’d rigged for it. Multiple outlets, including Unchained Crypto and blockchain-security firm Nexus Mutual’s incident report, describe the entire drain as taking under 12 minutes. Drift says about $9.2 million of the stolen funds were frozen in transit before the attackers could move them further.

Who did it

No one has been arrested, but the forensic picture points consistently toward North Korea’s state-linked hacking operations — the same broader apparatus behind the $1.5 billion Bybit theft in February 2025 and years of other crypto heists.

Blockchain analytics firms TRM Labs and Elliptic attributed the Drift attack with medium-to-high confidence to UNC4736, a cluster also tracked under the names AppleJeus and Citrine Sleet. Drift’s own investigation — which brought in incident-response firm Mandiant, asset-recovery firm zeroShadow, and the volunteer security group SEAL 911 — later pointed to a related group Mandiant internally tracks as UNC6862, describing a roughly six-month, in-person social engineering campaign rather than a purely remote operation. The discrepancy between UNC4736 and UNC6862 likely reflects different firms tracking overlapping parts of the same state-sponsored hacking infrastructure rather than a real disagreement about the hack’s origin.

Where the stolen money has gone since

The hack didn’t end on April 1 — the laundering has continued in waves throughout 2026, each one re-surfacing the story:

Date	Event	Approximate amount
April 1, 2026	Initial exploit drains Drift’s vaults	~$280-295 million
April 2026	~$9.2 million frozen in transit by exchanges/responders	$9.2 million
July 2026	Wallet “Drift Exploiter 4” deposits 23,095 ETH into Tornado Cash	~$44.4 million
October 1, 2026	Drift opens DFX recovery claims	Pool: ~$3.1-3.8 million
October 20, 2026	Wallet “Drift Exploiter 5” makes 258 deposits into Tornado Cash over ~2 hours	~$61-63 million

The October 20 movement, reported by CryptoSlate, Decrypt, and KuCoin (all citing on-chain data from Arkham Intelligence), saw the deposits start at 07:08 UTC and finish by roughly 09:21 UTC. Even after that transfer, wallets linked to the attacker — Arkham’s entity page tracks 71 addresses tied to the exploit — were still estimated to be holding on the order of 80,000+ ETH, worth well over $150 million at prices around that date. In other words: the hackers are still sitting on most of the money, and they’re laundering it in installments rather than all at once, likely to avoid flooding Tornado Cash and crashing the price of what they’re trying to cash out.

How Drift’s recovery plan actually works

Drift’s response combined an investigation with a multi-part financial restructuring:

• DFX recovery tokens. Every wallet with a verified loss from the April 1 exploit can claim transferable SPL tokens called DFX, each representing a claim on the recovery pool, via a Merkle-proof snapshot checked against the wallet that held funds on Drift at the time of the hack.
• A revenue-funded pool, not a lump-sum refund. The pool started with roughly $3.1-3.8 million in Drift’s own remaining assets, converted to USDT, and is designed to grow over time from a cut of trading revenue on Drift’s relaunched exchange, plus external backing. Tether has committed up to $127.5 million toward the effort, with additional partners contributing around $20 million more, according to The Defiant and FinanceFeeds.
• Floating, not fixed, redemption value. The amount a DFX token is worth isn’t locked in when you claim it — it’s the pool’s current balance divided by the outstanding DFX supply (fixed at about 299.5 million tokens) at the moment you redeem. Redemption is one-time and burn-on-redeem: once you cash out, that claim is gone, even if the pool grows richer later.
• A platform relaunch to fund it. Drift has rebranded its exchange as Velocity DEX, moving to a leaner, USDT-settled perpetuals-only product (dropping earlier features like Isolated Markets and Amplify) specifically to generate the ongoing revenue that feeds the recovery pool.
• A deadline. The DFX claim window closes at 00:00 UTC on January 1, 2028. Tokens that go unclaimed by then are permanently burned.

At the October 1 opening, the math worked out to about 0.0104 USDT per DFX token — meaning someone who lost 10,000 USDT worth of assets in the hack and claimed the full amount of DFX they were entitled to could redeem it for roughly $104 on day one. That rate is designed to rise as the pool grows, but there’s no guarantee of how fast, or whether it will ever approach full repayment.

Why this recovery looks so different from other famous DeFi hacks

Drift’s situation stands out specifically because the money never came back. Compare it with three other high-profile DeFi exploits:

Hack	Year	Amount	What happened to the funds
Poly Network	2021	~$611 million	Attacker returned nearly all funds within days, claiming to be a “white hat”
Mango Markets	2022	~$114 million	Attacker negotiated a return of most funds in exchange for a bug bounty and no criminal charges (he was later convicted anyway)
Euler Finance	2023	~$197 million	Attacker returned nearly all funds within weeks after public pressure and negotiation
Drift Protocol	2026	~$280-295 million	Attacker (state-linked, not a lone opportunist) has not returned funds; still laundering through Tornado Cash six+ months later

The earlier hacks were mostly carried out by individuals or small groups motivated by money and, in some cases, reputation — people who could be negotiated with, pressured publicly, or who wanted to avoid prosecution. A state-sponsored operation has none of those pressure points: there’s no one to negotiate with, no reputational cost that matters to a government intelligence service, and no realistic path to prosecution. That’s the structural reason Drift’s victims are being repaid out of future trading fees instead of getting their money back directly — because the money, functionally, is gone.

What this means if you used Drift, or any DeFi protocol

If you had funds on Drift during the April 2026 exploit, the practical reality is that a DFX claim today is worth about a penny on the dollar, with no fixed timeline for that to meaningfully improve, and a hard cutoff in January 2028 after which any unclaimed value disappears entirely. That’s materially different from protocols where attackers returned funds quickly — there, “recovery” meant getting most of your money back in weeks. Here, it means a long-dated, revenue-contingent claim with real risk that it never pays out much more than it does today. We’ve covered how differently crypto hacks can resolve before, including the string of hacks that made September 2026 crypto’s worst month for thefts and the $387 million Bitget hack — in both cases, as with Drift, most of the stolen money was never recovered by victims.

More broadly, the Drift case is a reminder that a protocol’s smart contract code being secure doesn’t mean the protocol is secure — the actual failure point was a handful of humans with multisig keys, targeted over months by people pretending to be business contacts. No audit of Drift’s code would have caught that, because the code worked exactly as written; it was fed false information by people who weren’t supposed to have the authority to feed it anything.

This article is for informational purposes only and isn’t financial advice. If you hold funds on any DeFi protocol, understand that recovery after a hack is never guaranteed, timelines can stretch for years, and payout rates — as Drift’s roughly 1-cent-on-the-dollar start shows — can be far lower than the headline “we’re compensating victims” announcements suggest. Do your own research before trusting any protocol’s multisig or admin-key setup with funds you can’t afford to lose.

The bottom line

Drift Protocol lost somewhere between $280 million and $295 million on April 1, 2026, to attackers whose methods point toward North Korea’s state hacking operations — not a code bug, but months of social engineering that compromised the humans controlling the protocol’s multisig. Six months later, the attackers are still laundering the proceeds in large batches through Tornado Cash, most recently moving $61-63 million on October 20, 2026, while Drift’s own recovery program pays claimants roughly a penny per dollar lost through a revenue-funded token that could take years to pay out meaningfully more. It’s one of the clearest examples yet of the gap between a DeFi hack making headlines and a DeFi hack’s victims actually getting their money back.