Drift Protocol was a decentralized perpetual futures exchange on Solana, and on April 1, 2026 it suffered the largest DeFi exploit of the year so far, with about $285 million drained in minutes after attackers gained control of administrator keys. TRM Labs attributed the attack to North Korean hackers. The protocol rebranded as Velocity on July 1, 2026, as a perpetuals-only exchange settling in USDT, and on October 1, 2026 it opened claims on a recovery pool that, at launch, paid only about 0.0104 USDT per dollar lost.
Key Facts
- What it was: a Solana DEX for perpetual futures, spot trading, lending and borrowing, with its own DRIFT governance token.
- The exploit: April 1, 2026, about $285 million taken, the largest DeFi hack of 2026 at the time (TRM Labs); Drift later put verified losses at about $295 million.
- Attack path: signers were socially engineered into pre-signing hidden transactions, and a fake token was accepted as collateral to borrow real assets (TRM Labs).
- Rescue plan: Tether pledged up to $127.5 million and partners about $20 million, for close to $148 million in total, released progressively rather than upfront (Decrypt, April 16, 2026).
- Settlement switch: the relaunched venue settles in USDT instead of USDC.
- Recovery token: one DFX per verified USDT lost; claims opened October 1, 2026 at about 0.0104 USDT per DFX from a pool of about 3.1 million USDT.
- DRIFT token: about $0.0135 with a market cap near $10 million (CoinGecko, October 25, 2026).
What Drift Did Before the Hack
Drift was built as a one-stop trading venue: perpetual futures with leverage on SOL, BTC, ETH and other markets, spot swaps, and a lending market where deposits doubled as trading collateral. That cross-margin design made it popular with active traders, because one deposit could back many positions. It also meant a large pool of assets sat under the protocol’s control, which is exactly what made the April exploit so damaging. Perps work very differently from the spot memecoin trading most Solana users know: you trade a contract that tracks a price, often with leverage, and positions can be liquidated.
How the April 2026 Exploit Worked
Investigators describe an attack that took months of preparation and minutes of execution. Attackers built trust with people who had privileged access, obtained control of admin authority, and then used it to list a worthless asset as collateral and borrow real assets against it. TRM Labs put the drain at about $285 million, taken mainly in USDC, JLP and other assets from Drift’s vaults. The lesson was not a clever smart contract bug but a governance one: whoever controls admin keys controls the protocol, a point explained in multisig wallets on Solana.
The Recovery Plan
| Element | What was announced | Where it stood in October 2026 |
|---|---|---|
| Tether contribution | Up to $127.5M, tied to platform activity | Not received as a lump sum |
| Partner contributions | Up to about $20M | Not a lump sum |
| Exchange revenue | 60-90% of daily net revenue to the pool, tiered | Main source so far |
| DFX claims | 1 DFX per USDT lost, about 299.5M DFX | Opened October 1, 2026, about 0.0104 USDT each |
The gap is the important number. The headline rescue was close to $148 million, but a pool of about 3.1 million USDT against roughly 299.5 million DFX means a user who lost $10,000 could redeem about $104 at launch. Holders can wait for the pool to grow or sell DFX, since the token is transferable. Claims are scheduled to stay open until January 1, 2028.
What This Means for Solana Users
- Admin keys are the real risk: a protocol is only as safe as whoever can change its parameters. Check whether upgrades and listings need a timelock and a wide multisig.
- Rescue headlines are not payouts: pledges tied to future revenue can take years to reach users.
- Diversify venues: keeping all collateral on one platform turns one exploit into a total loss.
Live TVL and revenue for the relaunched venue can be tracked on DefiLlama, and on-chain flows from the exploit addresses are visible on Solscan.
Admin Keys vs a Fixed Token Like $DOLAN
Drift’s loss came from control, not code: someone with admin authority could change what the protocol accepted as collateral. Simple tokens have a much smaller attack surface. DOLAN Duck ($DOLAN) is a fair-launch SPL token with a fixed 98.3M supply and roughly 10,700 holders; what matters for any such token is whether its mint and freeze authorities are revoked, because those are the token-level equivalent of admin keys. You can check both on an explorer in under a minute, as shown in how to read Solscan.
Drift Protocol was a Solana exchange for perpetual futures, spot trading and lending. After an exploit in April 2026, it rebranded as Velocity on July 1, 2026, as a USDT-settled perps venue.
About $285 million on April 1, 2026, according to TRM Labs, making it the largest DeFi exploit of 2026 at the time. Drift later put verified losses at about $295 million.
TRM Labs attributed the attack to North Korean hackers, who used a long social engineering campaign to gain privileged access.
Users received DFX recovery tokens, one per USDT lost. When claims opened on October 1, 2026, each DFX redeemed for about 0.0104 USDT, so recovery so far is around 1%.
Tether pledged up to $127.5 million, released progressively based on platform activity, and the relaunched venue switched its settlement asset from USDC to USDT.
Yes. CoinGecko showed DRIFT at about $0.0135 with a market cap near $10 million on October 25, 2026.