Drift Protocol: understanding the Solana hack and DFX compensation

A hack on Solana, funds tracked on Ethereum

On 1 April 2026, Drift Protocol suffered an attack resulting in approximately $295 million in user losses. In its recovery plan published in May, the team said it had suspended the protocol's main functions, including trading and borrowing, to limit further unauthorised movements.

Drift belongs to the Solana ecosystem. The fact that assets linked to the theft were subsequently tracked in Ethereum wallets does not change the network on which the protocol operated. Confusing these points would incorrectly present the incident as a hack of the Ethereum protocol itself.

In a June communication, Drift stated that Mandiant's investigation attributed the attack to the North Korean group UNC6862. This attribution comes from the investigative work presented by the protocol; it does not justify reducing every aspect of the intrusion to a simple authorisation granted by a user.

Tracking assets does not mean recovering them

Investigations also continue into subsequent movements. On 20 October, Cointelegraph reported the transfer of 25,700 ETH to Tornado Cash, based on Lookonchain's observations. This is a dated update on the tracking of funds, distinct from the technical description of the original attack.

The same article reported approximately 81,454 ETH in addresses associated with the attacker, according to Arkham. These balances represent an observation at a particular moment. They are neither a permanent estimate of available funds nor an amount already handed back to victims.

The distinction is particularly central: identifying an address, tracing a transfer and regaining possession of assets are three different stages. Drift's recovery plan mentions cooperation with the authorities and efforts concerning frozen funds. It does not present these efforts as the immediate reimbursement of all losses.

DFX represents a claim on a recovery fund

On 1 October, Drift announced the opening of DFX claims and redemptions. Each USDT of verified loss entitles its holder to one DFX. This token is distinct from the DRIFT governance token: receiving a recovery unit therefore does not automatically mean receiving a dollar in reimbursement.

At opening, the fund contained approximately 3.1 million USDT. The redeemable amount per DFX depends on the fund balance divided by the supply of DFX still outstanding. A redemption request burns the tokens concerned and pays the corresponding USDT amount calculated under this mechanism.

The announced funding includes a portion of Velocity revenue, any funds recovered and partner commitments. Announced support packages for the relaunch must not be equated with amounts already fully available. The arrangement's tracking dashboard shows the actual position.

Rebuilding does not eliminate the risks

The June communication also describes work to rebuild the protocol: strengthening code, reviewing liquidation mechanisms and addressing risk parameters. These measures explain the relaunch strategy. They do not establish a certain date for every victim to receive full reimbursement.

For users, official communications and applicable conditions remain the reference points. Fake support messages and promises of guaranteed repayment can exploit uncertainty. No legitimate contact should receive a recovery phrase or private key supposedly needed to unlock compensation.