Key Takeaways
- • Tether commits up to $127.5 million of a $150 million total recovery fund to support Drift Protocol users following an April 1 exploit that drained $270–$285 million from the Solana-based perpetuals exchange.
- • Recovery structure ties user repayments to platform trading revenue rather than upfront capital, with additional recoveries from law enforcement and blockchain forensics efforts flowing into a dedicated recovery pool.
- • Drift Protocol will replace USDC with USDT as its settlement asset at relaunch, onboarding 128,000 affected users and 35 ecosystem teams onto Tether's stablecoin infrastructure on Solana.
- • The exploit resulted from a six-month infiltration by North Korean state-linked actors who compromised multisig approvals through malicious TestFlight and VSCode vulnerabilities, draining USDC, SOL, and JLP token vaults.
- • Drift's native token (DRIFT) recovered 22% following the announcement, rising from $0.045 to $0.055, after losing 30% in the immediate aftermath; protocol TVL declined from $550 million pre-exploit to approximately $243 million at announcement.
Summary
Drift Protocol, a Solana-based perpetuals exchange, secured recovery backing of nearly $150 million in collaboration with Tether and other partners following a catastrophic exploit on April 1, 2026. Tether, the stablecoin issuer, committed up to $127.5 million to the recovery structure, with additional support from unnamed partners. Tether CEO Paolo Ardoino characterized the intervention as reflecting the company's commitment to supporting the digital asset ecosystem during periods of stress, stating: "The focus is on restoring user confidence and supporting a strong relaunch, with a structure that aligns recovery with real activity and long-term growth."
The recovery plan structure departs from conventional bailout models by tying user repayments directly to platform trading activity rather than deploying capital as a one-time allocation. The mechanism establishes a dedicated recovery pool fed by Drift exchange revenue and committed support capital, with additional assets from ongoing law enforcement and blockchain forensics efforts. This revenue-linked approach incentivizes protocol restart and sustainable operations. The package includes a $100 million revenue-linked credit facility, ecosystem grants, and loans designated for market makers.
The April 1 attack, attributed to North Korean state-linked actors by blockchain analytics firm Elliptic, resulted in losses between $270 million and $285 million. The compromise reportedly required six months of preparatory infiltration during which attackers posed as a quantitative trading firm, built relationships at industry conferences, and deployed malicious applications including a compromised TestFlight app and VSCode vulnerability. Attackers exploited Solana's durable nonces feature to manipulate Drift's multisig approvals and drain core vaults containing USDC, SOL, and JLP tokens. The incident affected over 128,000 users and reduced Drift's total value locked from $550 million pre-exploit to $243 million at announcement.
As part of the relaunch initiative, Drift will migrate its settlement asset from USDC to USDT, positioning Tether's stablecoin as the primary medium of exchange. The transition onboards 128,000 affected users and 35 ecosystem teams—including Gauntlet, Neutral, and M1—onto USDT infrastructure, substantially increasing Tether's footprint in Solana-based trading. Before resuming operations, all protocol components will undergo independent security audits from OtterSec and Asymmetric Research. Drift will issue a new transferable token to affected users to facilitate recovery asset distribution; additional token mechanics details were expected to follow announcement. The DRIFT native token appreciated 22% following the recovery plan disclosure, rising from $0.045 to $0.055 per CoinGecko data.
The recovery plan structure departs from conventional bailout models by tying user repayments directly to platform trading activity rather than deploying capital as a one-time allocation. The mechanism establishes a dedicated recovery pool fed by Drift exchange revenue and committed support capital, with additional assets from ongoing law enforcement and blockchain forensics efforts. This revenue-linked approach incentivizes protocol restart and sustainable operations. The package includes a $100 million revenue-linked credit facility, ecosystem grants, and loans designated for market makers.
The April 1 attack, attributed to North Korean state-linked actors by blockchain analytics firm Elliptic, resulted in losses between $270 million and $285 million. The compromise reportedly required six months of preparatory infiltration during which attackers posed as a quantitative trading firm, built relationships at industry conferences, and deployed malicious applications including a compromised TestFlight app and VSCode vulnerability. Attackers exploited Solana's durable nonces feature to manipulate Drift's multisig approvals and drain core vaults containing USDC, SOL, and JLP tokens. The incident affected over 128,000 users and reduced Drift's total value locked from $550 million pre-exploit to $243 million at announcement.
As part of the relaunch initiative, Drift will migrate its settlement asset from USDC to USDT, positioning Tether's stablecoin as the primary medium of exchange. The transition onboards 128,000 affected users and 35 ecosystem teams—including Gauntlet, Neutral, and M1—onto USDT infrastructure, substantially increasing Tether's footprint in Solana-based trading. Before resuming operations, all protocol components will undergo independent security audits from OtterSec and Asymmetric Research. Drift will issue a new transferable token to affected users to facilitate recovery asset distribution; additional token mechanics details were expected to follow announcement. The DRIFT native token appreciated 22% following the recovery plan disclosure, rising from $0.045 to $0.055 per CoinGecko data.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.