Drift Protocol today released a detailed recovery framework for users affected by a $295 million exploit on April 1, as the platform moves toward a relaunch.
The attack, attributed by forensic firm Mandiant to a DPRK-linked actor, forced the protocol to halt trading and borrowing. A month later, the team says recovery efforts are underway, though a full restoration of user funds will depend on multiple funding sources and governance approvals.
Majority of stolen funds still traceable
Drift said most of the stolen assets remain identifiable on-chain, with limited success by the attacker in off-ramping funds.
Roughly 130,000 ETH, valued at about $293 million, has been tracked across a small number of wallets under continuous monitoring. Some assets moved cross-chain infrastructure linked to Wormhole have been delayed, effectively locking them until at least late July.
In parallel, transfers involving stablecoins through infrastructure operated by Circle have been frozen. Drift said it is working with authorities to secure legal approval to reissue those funds back to the protocol, though no timeline has been confirmed.
Recovery token model to track user losses
The core of the plan is a “recovery token” that will be issued to every affected wallet. Each token represents one dollar of verified loss based on a snapshot of user balances taken at the time the protocol was paused.
These tokens are separate from Drift’s governance token and are designed to function as claims on a recovery pool. Users will be able to redeem them once sufficient funds accumulate, though early redemption reduces any future claim if additional funds are recovered later.
Recovery pool backed by multiple funding streams
Initial funding for the recovery pool comes from remaining protocol assets, currently estimated at around $3.8 million, which will be converted into stablecoins to stabilize value. From there, the pool is expected to grow through ongoing exchange revenue, external capital, and a separate commitment from Tether of up to $127.5 million tied to platform performance. Additional partners have pledged up to $20 million.
Drift said the pool will continue accumulating until it matches total losses of approximately $295.4 million, at which point recovery tokens can be redeemed at full value.
Insurance fund and governance decisions pending
The protocol’s insurance fund, estimated at about $20 million before the attack, was not impacted. However, its eventual use, whether distributed to depositors or added to the recovery pool, will be decided through a DAO vote.
Key elements of the recovery plan, including final asset treatment and token mechanics, will also be subject to governance proposals before implementation.
Why assets won’t be returned directly
Drift said it will not return remaining assets directly to depositors due to the structure of its pooled liquidity system. Since borrowing and lending rely on shared liquidity, immediate withdrawals could create imbalances and disrupt the protocol’s accounting.
Instead, converting assets into stablecoins and distributing value through the recovery pool is intended to ensure obligations are settled in sequence without further destabilizing the system.
Ongoing recovery and bounty efforts
The protocol said it is continuing recovery efforts with support from cybersecurity firms and partners. A public bounty program offering 10% of recovered funds has been launched in coordination with exchanges, including Bybit, aiming to incentivize white-hat participation.
Drift is targeting a relaunch in the second quarter of 2026 with a narrower product focus and updated security architecture. Planned changes include new smart contract deployments with rotated keys, stricter operational security for multisig signers, and the removal of features that expanded the attack surface. The platform will prioritize perpetual futures trading, while some existing products may be discontinued or delayed.
Stablecoin usage will also be streamlined, with USDT expected to serve as the primary collateral and settlement asset.
Next steps
A timeline for reopening withdrawals and launching the recovery token has not yet been announced. Drift said further details will depend on governance approvals and progress in fund recovery.
For now, the recovery plan sets out a structured path, but full reimbursement of losses will hinge on execution, external support, and the outcome of ongoing legal and recovery efforts.
