Drift Protocol announced on Tuesday a detailed recovery framework for users affected by a $295 million exploit that occurred on April 1 and has been attributed to the North Korean state-backed DPRK hacking group, identified by forensic firm Mandiant.
The attack forced the protocol to immediately halt all trading and borrowing activities. According to Drift, the majority of the stolen assets remain traceable and contained, with approximately 130,259 ETH (roughly $31 million) concentrated across four monitored wallets. A total of about $295.4 million in losses was identified.
The core of the recovery plan is the issuance of a recovery token, with each token representing $1 of verified user loss. These tokens will be redeemable at a future date when a dedicated recovery pool reaches sufficient value. The pool currently holds about $3.8 million in remaining protocol assets and is expected to grow through exchange-generated revenue, up to $127.5 million in performance-linked support from Tether, and up to $20 million from partner contributions. Once the pool equals the total loss amount, recovery tokens can be redeemed at full value.
Some funds have already been frozen, including approximately $3.36 million in USDC, while other assets remain delayed in cross-chain transfers. Drift is also pursuing legal avenues to seize and reissue assets and has launched a public bounty offering 10% of any recovered funds. Final decisions on the recovery plan will be subject to governance votes, the team noted.
To prevent future incidents, Drift plans to relaunch in the second quarter as a “security-first” exchange, implementing new multisig controls, time-locked operations, regular key rotation, and a reduced product scope focused exclusively on perpetuals trading.
The announcement comes one week after Aave revealed it is coordinating a DeFi-wide recovery effort for Kelp DAO, which suffered a nearly $280 million exploit also attributed to North Korean hackers. In that case, Aave has mobilized donations, deposits, and credit lines from across the crypto space.
