Drift Protocol: What It Was, the April 2026 Exploit and the Move to Velocity

Drift ran as one Solana program in which each user account held collateral across several markets. That collateral backed perpetual futures (leveraged contracts with no expiry), spot trades and borrow/lend positions at the same time ⁵. By September 2024, Drift reported more than 200,000 users and over $50 billion in cumulative volume. It had also launched BET, a prediction-market product ⁵. It raised a $23.5 million Series A in May 2023 and a $25 million Series B in September 2024 ⁵⁶. Governance ran through the DRIFT token and DAO votes ³⁸.

Because every borrow/lend market drew on one shared liquidity pool, a loss in that pool affected every depositor. This later shaped how the recovery was designed ³.

The April 1 attack was an operational-security breach, not a bug in Drift's smart contracts. The program processed transactions that were validly signed by its own multisig ¹. According to Nexus Mutual's incident analysis ¹:

1. Months of social engineering. From late 2025, attackers posing as a quant trading firm built relationships with Drift contributors. They even deposited over $1 million of their own capital into an ecosystem vault.
2. Compromised devices. At least two contributors' machines were infected through a malicious code repository (exploiting a VS Code/Cursor flaw) and a fake TestFlight app.
3. Pre-signed approvals. The attackers obtained approvals from 2 of 5 Security Council members using Solana "durable nonces," which keep a signed transaction valid indefinitely. On March 27 the Council had moved to a zero-timelock setup.
4. A fake collateral token. They created "CVT," seeded about $500 of liquidity and wash-traded it to build a price history Drift's oracles accepted.
5. The drain. On April 1 they listed CVT as collateral, raised withdrawal limits to absurd levels, deposited CVT and withdrew real assets in 31 transactions over 12 minutes. These included $155.6M of JLP, $60.4M of USDC and $11.3M of cbBTC, plus USDT, WETH, dSOL and WBTC ¹.

Most of the USDC was bridged to Ethereum and the rest moved through Tornado Cash ¹. TRM Labs and Elliptic attributed the attack to a North Korean state-affiliated group, UNC4736 ¹. Drift's own update cites Mandiant naming UNC6862, also described as North Korean ¹³. More than 20 Solana protocols that used Drift vaults reported knock-on losses ¹. Drift was not covered by Nexus Mutual, whose cover excludes social-engineering losses in any case ¹. For background on this attack style, see crypto phishing.

Drift snapshotted all positions at the moment of the pause (18:31:47 UTC, April 1). It valued them using oracle prices from 16:06 UTC, before the attack began ³. Spot deposits are not returned in kind, because the lending pool was shared ³. Instead, verified losses were converted into DFX ¹²:

• Supply: fixed at 299,500,810.998 DFX, one per USDT of verified loss.
• Claiming: claims are made at dfx.drift.trade from the wallet that controlled the Drift account on April 1, 2026. The window closes at 00:00 UTC on January 1, 2028, and unclaimed DFX is burned.
• Redemption: redeeming burns DFX for a share of the recovery pool (pool balance ÷ outstanding DFX). At launch on October 1, 2026, the pool held about 3.1 million USDT, or roughly 0.0104 USDT per DFX, about 1% of face value ¹²¹⁵. Redemption is final, and holders who wait receive a share of later deposits.
• Funding sources: a tiered share of Velocity's daily net revenue (60–90%, depending on volume), up to 127.5 million USDT from Tether, up to 20 million USDT from partners, and any recovered funds ¹². About 130,259 ETH remained in attacker wallets as of May 2026. Circle froze $3.36M of USDC, and a 10% bounty is on offer ²³.

DFX is transferable and trades on Raydium, but Drift makes no promise about its price or the size of future deposits ¹². Full repayment depends on Velocity's revenue, partner money actually arriving and further asset recovery ¹⁵.

Velocity is a fork of Drift v2, deployed as a new Solana program (vELoC1audYbSYVRXn1vPaV8Axoa9oU6BYmNGZZBDZ1P). It is not an upgrade of the old one, and no accounts or balances carry over ¹¹. As of October 2026 ¹⁰¹¹¹⁴:

• Products: perpetual futures only. Spot order-book trading, prediction markets and high-leverage mode were removed. Borrow/lend, Insurance Fund staking and vaults remain. Listed perps include BTC, ETH, SOL and HYPE, and equity perps are marked "coming soon."
• Collateral: USDT replaces USDC as the settlement asset. Sending USDC to a Velocity account is the wrong token.
• Leverage: up to 20x on select markets.
• Fees: taker fees of 4 bps of notional, falling to 3 bps above $5M and 2 bps above $80M of 30-day volume, plus up to 10 bps on some markets. Makers receive a 0.25 bp rebate. Funding is paid between longs and shorts.
• Security changes: a tiered cold/warm/hot admin-key model, with routine parameter changes behind a timelock and a pause key that can freeze but not unfreeze. OtterSec audited the post-fork program and reported 154 findings, none critical, with all high-severity items fixed. The code is not yet open source.

Velocity's own risk page warns about several remaining risks. Pyth oracle errors can liquidate solvent accounts. The insurance fund is capped by market tier, and shortfalls can be socialized to traders or lenders. Withdrawal circuit breakers can slow large exits. Admins can change margin ratios and fees while positions are open ¹⁰. Comparable on-chain perps venues include Hyperliquid, dYdX and GMX.

dSOL is a Solana liquid staking token associated with Drift. DefiLlama first listed it in August 2024 and lists no published audits ⁹. Holders own staked SOL that can be used elsewhere while it earns staking rewards. dSOL held as collateral inside Drift was among the assets drained on April 1 ¹. The token itself kept trading: DefiLlama counted about $291 million in dSOL on October 23, 2026 ⁹. Drift's recovery posts don't address dSOL directly and refer holders with questions to Discord support ³. See also the separate rating and evidence for Drift Staked SOL.