Six months after an April 1 exploit drained approximately $295.4 million from the Drift Protocol, victims began claiming recovery tokens on October 1. The Drift Foundation opened redemptions for DFX, a Solana-based token representing verified losses, though initial payouts remain modest.
The recovery pool launched with $3.11 million, translating to roughly 0.0104 USDT per DFX token. A verified $1,000 loss is currently worth approximately $10.40 in redeemable value. Supply is fixed at 299,500,810.998 DFX tokens, with the foundation stating no new tokens will be minted.
Victims face three options: redeem tokens immediately for USDT, sell DFX on secondary markets like Raydium, or hold and wait as the recovery pool grows. Once redeemed, the transaction is final.
Recovery Pool Growth Mechanisms
The foundation structured DFX to incentivize holders to wait. The recovery pool is designed to only grow, while the redemption amount never falls and token supply only shrinks through redemptions. As DFX is redeemed and removed from circulation, remaining tokens receive a larger share of future deposits.
Velocity, Drift's rebuilt exchange, will funnel a portion of its daily net protocol revenue into the pool. Tether has committed up to 127.5 million USDT, while strategic partners pledged another 20 million USDT. Recovered stolen assets are also expected to enter the pool. However, the foundation cautioned that these commitments "are not a projection or a promise."
By the first Friday after claims opened, approximately 216,480 DFX had been redeemed for roughly 2,250 USDT, while Velocity's initial daily revenue contribution totaled 31 USDT. Partner funds had not yet arrived.
The claim window closes January 1, 2028. Unclaimed tokens become invalid after that date.
The April Exploit
Investigators attributed the April 1 attack to a North Korea-linked group that spent months posing as a quantitative trading firm. The attackers obtained administrative control by tricking Drift Security Council members into pre-signing transactions.
At approximately 16:05 UTC, the compromised signatures granted access. Attackers listed a worthless token called CVT as collateral, deposited 500 million tokens at an artificial price near $1, and withdrew real assets including approximately $159.3 million in JLP and $71.4 million in USDC. Assets were swapped and bridged to Ethereum within minutes.
Chainalysis estimated the total haul at roughly $285 million. Most of that loot remains unrecovered, though Drift reported approximately 130,259 ETH sitting across four Ethereum wallets. About 23,094 ETH had passed through the Tornado Cash mixer, while roughly $9.2 million had been frozen elsewhere.
A bounty operated by Bybit offers 10% of assets recovered. Any funds obtained through freezes, law enforcement, or the bounty program are directed to the DFX recovery pool.
