How Solana Exchange Drift Plans to Repay Users After $295 Million Crypto Hack

In brief

• Solana-based Drift Protocol was hacked on April 1, with $295 million in user funds drained by attackers linked to North Korea.
• Drift Protocol will issue recovery tokens to affected wallets, with each token representing $1 of verified loss.
• Tether committed up to $127.5 million in recovery funds, with strategic partners pledging an additional $20 million.

A month after North Korean-affiliated hackers drained $295 million in user funds from decentralized crypto exchange Drift Protocol, the Solana-based platform has released a detailed recovery plan outlining how it intends to compensate affected users and relaunch as a rebuilt, security-focused exchange.

The April 1 attack was attributed to a North Korea state-affiliated threat actor, as confirmed by forensic firm Mandiant. Following the exploit, Drift temporarily suspended all core protocol functions—including trading and borrowing—to prevent further unauthorized activity.

Approximately 130,259 ETH, worth roughly $293 million today, remains concentrated across four Ethereum wallets that are actively monitored and have been flagged across exchanges. Two additional transfers via the Wormhole bridge have been delayed by that protocol’s governor until late July, effectively locking funds in transit. Three stablecoin transfers have also been frozen by Circle, totaling $3.36 million worth of USDC.

To compensate victims, Drift plans to issue each affected wallet a "recovery token," where each token represents $1 of verified loss. A recovery pool will be seeded with the protocol's remaining assets—approximately $3.8 million converted to stablecoins—and will grow through quarterly exchange revenue along with up to $127.5 million committed by stablecoin issuer Tether and up to $20 million from additional strategic partners.

Users can begin redeeming their tokens once the recovery fund exceeds $5 million, though early redemption means forfeiting any future claims on the pool. The pool will keep growing until total inflows match the full $295,426,725.97 in exploit losses.