Loading story…
Drift opened claims and redemptions for its DFX recovery token following the April 1 exploit that produced approximately $299.5 million in verified user losses. The initial Recovery Pool holds roughly $3.11 million USDT, giving DFX an opening redemption value of about 0.0104 USDT per token—approximately 1.04% of eligible losses. Users can claim DFX through the wallet that controlled their Drift account at the loss snapshot, then hold, trade, or redeem it; claims close on January 1, 2028 UTC.
The recovery program is intended to receive future funding from a tiered share of Velocity’s net protocol revenue, any recovered stolen assets, and potential commitments from Tether and strategic partners. Tether had previously announced support for a $150 million Drift recovery plan and a stabilized relaunch, alongside Drift’s plans to expand USDT usage on Solana; however, the initial pool represents only a small fraction of the verified losses.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
Drift opened claims and redemptions for DFX, a recovery token with a supply corresponding to verified losses from the exploit. Its Recovery Pool launched with roughly 3.11 million USDT, giving DFX an initial redemption value of about 0.0104 USDT per token, or approximately 1.04% of verified losses.
An exploit affecting Drift caused approximately 299.5 million USDT in verified user losses. The loss snapshot later used for recovery allocations was tied to wallets controlling Drift accounts on this date.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
thedefiant.io
Open sourcetether.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Drift Protocol, a Solana-based decentralized exchange, lost roughly **$270 million to $286 million** after attackers seized its Security Council administrative powers and drained core vaults, prompting the platform to suspend deposits and withdrawals and warn users not to add funds. Drift later said the theft was not caused by a smart contract bug or leaked seed phrases, but by a sophisticated operation that abused Solana **durable nonce** transactions and pre-signed multisig approvals to execute malicious governance changes later. Investigators and Drift said the attackers removed withdrawal limits, introduced a fake collateral asset called **`CVT`** or CarbonVote Token, manipulated controls, and rapidly moved assets out of borrow/lend products, vault deposits, and trading funds, cutting the protocol’s total value locked from about **$550 million** to below **$250 million** and sending the **DRIFT** token sharply lower. Subsequent post-mortems described the breach as the culmination of a **months-long social-engineering campaign** in which the threat actors posed as a legitimate quantitative trading firm, built trust through conferences, Telegram chats, integrations, and deposits, and likely compromised contributors through a malicious code repository and a trojanized TestFlight wallet app. Blockchain intelligence firms including **Elliptic** and **TRM Labs** said the laundering patterns, cross-chain bridging from Solana to Ethereum, use of **Tornado Cash**, and other indicators were consistent with **North Korean** tradecraft, while Drift linked the operation with medium confidence to **UNC4736 / AppleJeus / Citrine Sleet**. The fallout widened beyond Drift as critics questioned why more than **$230 million in USDC** moved through Circle’s CCTP bridge without being frozen, Solana launched new security initiatives, and Drift later secured recovery backing including up to **$127.5 million from Tether** as it worked with security firms, exchanges, bridges, and law enforcement to trace and recover funds.
Jun 29, 2026
Drift Protocol, a Solana-based decentralized trading platform, said attackers stole about **$280 million to $285 million** after a months-long intrusion culminated in the takeover of administrative control and the draining of protocol vaults in roughly 12 minutes. Drift’s preliminary findings said the operation abused Solana’s **durable nonce** feature and pre-signed transactions rather than a simple smart contract flaw, while investigators reported that the attackers staged activity weeks in advance, created a fake asset called **CarbonVote Token (`CVT`)**, and manipulated its trading history so protocol oracles would accept it as collateral. The stolen assets were then swapped largely into **USDC** and **SOL**, bridged to Ethereum through Circle’s Cross-Chain Transfer Protocol, and moved onward through additional services and exchanges.
Jul 1, 2026
Drift Protocol was compromised after an attacker gained control of a newly created `2-of-5` Squads v4 admin multisig during a migration from an older `3-of-5` setup. Investigation notes say the migration replaced four of five original members, lowered the approval threshold, and left no timelock, allowing the attacker—who controlled two signer accounts—to use a dual durable nonce pre-signing technique to transfer protocol admin rights to a wallet under their control in less than two seconds. Shortly before the admin takeover, the attacker also withdrew **$10,000 USDC** from the insurance fund. With unilateral admin access, the attacker used the `UpdateWithdrawGuardThreshold` capability to remove withdrawal caps across **16 spot markets**, then created fake collateral markets backed by an attacker-controlled token and oracle to extract real assets from the protocol. Public proof-of-concept material highlighted how the withdrawal guard change could eliminate all withdrawal limits, while on-chain analysis linked the attacker-controlled signers through durable nonce accounts funded by the same wallet, identifying shared nonce funding as a key early warning indicator. Drift later moved protocol upgrade authority to a recovery multisig that excluded the compromised members, but reporting indicated Drift Vaults upgrade authority still remained on a multisig where the attacker retained a seat.
Jun 29, 2026