On Tuesday, Drift Protocol announced a recovery plan for users impacted by a $295 million exploit on April 1, attributed to the North Korea-backed DPRK hacking group identified by Mandiant. The protocol suspended trading and borrowing immediately following the breach. According to Drift, most of the stolen assets are traceable and contained, with about 130,259 ETH (approximately $31 million) concentrated in four monitored wallets.
Drift’s recovery initiative involves issuing a token that represents verified user losses, where each token signifies $1 worth of loss. Token holders will have redemption rights based on the value accumulated in a recovery pool over time. This pool initially contains about $3.8 million from remaining protocol assets and is projected to expand through exchange revenue, up to $127.5 million from Tether contingent on performance, and up to $20 million from partners, as stated by Drift. The fund will continue accruing until it matches total losses of roughly $295.4 million, at which point tokens can be redeemed at face value.
Drift reported that some funds have already been frozen, including approximately $3.36 million in USDC, with additional assets delayed due to cross-chain transfers. Legal actions to recover and reissue these funds are ongoing, the protocol noted. It has also introduced a public bounty program offering 10% of recovered assets.
Drift plans to relaunch as a “security-first” exchange in the second quarter, implementing changes such as new multisig controls, time-locked operations, key rotation, and a narrowed product focus on perpetuals trading. The team emphasized its commitment to making users whole, with final decisions pending governance votes.
This announcement follows Aave’s coordination of a DeFi recovery effort for Kelp DAO after it suffered a nearly $280 million exploit by the same North Korean-backed hackers last week. In that instance, Aave successfully secured donations, deposits, and credit lines from across the crypto sector.