Key Takeaways
- • Pyra ceases operations following exposure to the Drift Protocol exploit, shutting down its asset neobank platform on Solana after the platform's users and business were "hit extremely hard" by the security breach.
- • Drift Protocol suffered a $285–$290 million hack attributed to North Korean threat actors on April 1, 2026, with attackers removing withdrawal limits, overriding vault permissions, and draining funds using fake collateral—the largest DeFi hack on record.
- • Drift's total value locked collapsed from approximately $550 million to under $250 million in the aftermath of the exploit, triggering a severe loss of confidence in the protocol and cascading impact on dependent platforms like Pyra.
- • Drift has launched a user recovery plan and fund withdrawal portal, beginning with compensation issuance and staking unstaking mechanisms subject to a 13-day cooldown period, while confirming its insurance fund remained untouched during the attack.
- • The Drift incident underscores systemic vulnerability in DeFi composability, where a single protocol compromise cascades through interconnected platforms, resulting in forced shutdowns of downstream services and investor losses across the ecosystem.
Summary
Pyra, a Solana-based asset neobank that launched publicly in May 2025 and positioned itself as a "DeFi-native bank replacement" enabling users to earn yield, hold assets, and spend without triggering capital gains taxes, has announced it is shutting down operations. The company disclosed on June 16, 2026, that after evaluating every available path forward, it made the "difficult decision to wind down Pyra and end operations." The shutdown follows direct exposure to the Drift Protocol security breach, with Pyra explicitly stating that "our business and users were hit extremely hard by the Drift exploit."
The underlying trigger was the Drift Protocol hack that occurred on April 1, 2026, when attackers attributed by threat intelligence firm TRM to North Korean state-linked actors drained between $285 million and $290 million from the decentralized finance platform. According to available evidence, the attack involved a systematic exploitation sequence: attackers removed withdrawal limits, overridden vault permissions, and drained real funds by deploying fake collateral. This represents the largest DeFi hack to date. Following the incident, Drift Protocol suspended deposits and withdrawals while investigating the breach, and Drift's total value locked (TVL) collapsed from approximately $550 million to under $250 million, reflecting a roughly 55% destruction of protocol value.
Pyra's reliance on Drift Protocol as a core component of its yield and collateral infrastructure made the platform untenable following the attack. The neobank had built its value proposition around depositing assets into Drift to generate returns while maintaining a credit line backed by those holdings. With Drift's security compromised and user confidence evaporated, Pyra's business model became unviable. The company is establishing a fund withdrawal portal to facilitate user asset recovery, though specifics on timing and potential losses remain limited in available disclosures.
Drift Protocol has initiated a user recovery plan following the exploit, beginning with compensation issuance and allowing users to unstake assets from the insurance fund, though withdrawals are subject to a 13-day cooldown period. The protocol confirmed that its insurance fund itself remained untouched during the attack. However, these measures appear insufficient to prevent downstream operational failures in dependent platforms like Pyra. The incident underscores a critical structural risk in DeFi composability: a single protocol compromise can trigger cascading failures across an interconnected ecosystem, destroying value not only for direct users but also for downstream platforms whose business models depend on protocol solvency and security.
The underlying trigger was the Drift Protocol hack that occurred on April 1, 2026, when attackers attributed by threat intelligence firm TRM to North Korean state-linked actors drained between $285 million and $290 million from the decentralized finance platform. According to available evidence, the attack involved a systematic exploitation sequence: attackers removed withdrawal limits, overridden vault permissions, and drained real funds by deploying fake collateral. This represents the largest DeFi hack to date. Following the incident, Drift Protocol suspended deposits and withdrawals while investigating the breach, and Drift's total value locked (TVL) collapsed from approximately $550 million to under $250 million, reflecting a roughly 55% destruction of protocol value.
Pyra's reliance on Drift Protocol as a core component of its yield and collateral infrastructure made the platform untenable following the attack. The neobank had built its value proposition around depositing assets into Drift to generate returns while maintaining a credit line backed by those holdings. With Drift's security compromised and user confidence evaporated, Pyra's business model became unviable. The company is establishing a fund withdrawal portal to facilitate user asset recovery, though specifics on timing and potential losses remain limited in available disclosures.
Drift Protocol has initiated a user recovery plan following the exploit, beginning with compensation issuance and allowing users to unstake assets from the insurance fund, though withdrawals are subject to a 13-day cooldown period. The protocol confirmed that its insurance fund itself remained untouched during the attack. However, these measures appear insufficient to prevent downstream operational failures in dependent platforms like Pyra. The incident underscores a critical structural risk in DeFi composability: a single protocol compromise can trigger cascading failures across an interconnected ecosystem, destroying value not only for direct users but also for downstream platforms whose business models depend on protocol solvency and security.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.