Drift Foundation

The official Drift Foundation account powering the Drift Ecosystem.

Accelerating the future of DeFi trading.

[Drift Foundation @DriftFDN]

All open positions, perp and spot, were snapshotted when the protocol paused at 18:31:47 UTC on 1 April. Balances were calculated using oracle prices from 16:06 UTC that day, before the attack began. Your DFX allocation is based on that snapshot.

Full methodology: https://t.co/WLtUJcwAU4

[Drift Foundation @DriftFDN]

DFX Claims and Redemptions are now live.

If you had a verified loss from the 1 April incident, you can claim 1 DFX for every 1 USDT lost.

Claim: https://t.co/UtOBzjqlRi
How it works: https://t.co/4LBOYnlIfe

The claim window closes at 00:00 UTC on 1 January 2028. Unclaimed DFX will be burned.

[Drift Foundation @DriftFDN]

https://t.co/Xo96Hqmjm3 is the only official link.

[Drift Foundation @DriftFDN]

We've read your replies. Here are answers to the main questions.

DFX is not pegged to 1 USDT. You receive 1 DFX for every 1 USDT of verified loss, and what you receive when you redeem depends on the Recovery Pool Balance at that time.

The Recovery Pool covers around 1% of total claims today. Redeeming is optional. You can hold DFX and keep your claim on the Recovery Pool as deposits arrive and supply falls, or trade it on secondary markets like Raydium.

Tether has committed up to 127.5M USDT to support relaunch and user recovery, matched against Velocity's Net Protocol Revenue. It isn't a lump sum that has already been received.

The 1 January 2028 deadline is for claiming. DFX you've already claimed is not burned.

If your claim failed, your allocation is safe. Please retry. Wallet warnings on the site have been resolved.

[Drift Foundation @DriftFDN]

@vasamonte @Backpack Thanks for flagging. This has been resolved with the @Backpack team.

[Drift Foundation @DriftFDN]

@bencrox The ~3.1M USDT in the Recovery Pool is the remaining non-stolen assets, sold and deposited.

The validator stake is users' SOL staked via dSOL. It belongs to dSOL holders, not the protocol.

[Drift Foundation @DriftFDN]

@Alexand15936259 @tracybbd Please refer here for DRIFT Token update
https://t.co/p0C8kic1es

[Drift Foundation @DriftFDN]

Drift Recovery Update

An update on the ~$295.4M taken from Drift users on 1 April, and where recovery efforts stand.

Drift Foundation will continue pursuing efforts to track, trace, and recover stolen funds. Recovered funds, whether they come back through a freeze, bounty, or through law enforcement, shall be directed into the DFX recovery pool.

Mandiant, zeroShadow, and SEAL 911 were brought in to investigate and trace the funds. Mandiant identified the attacker as UNC6862, a North Korean threat group. Since April, zeroShadow has tracked the stolen funds, including the laundering that began in July, and has shared its findings with law enforcement.

—

Where the funds are

The stolen funds were bridged to Ethereum, ~130,259 ETH across four wallets. Three of those four wallets have not moved and currently hold 107,165 ETH. On 23 July, one of the wallets sent about 23,094 ETH into Tornado Cash.

Working together with zeroShadow and law enforcement, the Foundation continues to track and flag every withdrawal as it appears, and monitor all wallets around the clock.

Some of those stolen funds have been transferred across multiple blockchains and jurisdictions, making the process of recovering and returning frozen funds complex and time-consuming.

—

Frozen funds

About $9.2M of stolen funds has been frozen so far, after the attacker moved them through Tornado Cash in August.

Recovering frozen funds involves law enforcement and is a process that takes time. We are actively working on this and will share updates as soon as there is progress.

—

DRIFT token

The Foundation is also evaluating the best path forward for the DRIFT. Foundation's priority remains asset recovery and establishing the token's future pathway within the broader DRIFT ecosystem.

—

Bounty Program

In collaboration with Bybit, the Foundation has launched a public bounty program: a 10% bounty on any successfully recovered funds. The program is listed publicly to maximize participation from white hats, security researchers, and the broader ecosystem.

https://t.co/9UXZ69BaWp

—

A word of caution: The Foundation will never message you directly about recovered funds, ask you to connect a wallet, or ask for a fee. Anyone who does this is not from the Drift Foundation. Follow official channels for official updates.

Foundation will share the next update when there is further progress to report.

[Drift Foundation @DriftFDN]

@AIRDROPINTELLAB To clarify, Tether has committed up to 127.5M USDT to support relaunch and user recovery, matched against Velocity's Net Protocol Revenue.

It isn't a lump sum that has already been received. The ~3.1M in the Recovery Pool today is the starting balance, and it grows daily.

[Drift Foundation @DriftFDN]

We will never DM you, ask for a fee, or ask you to connect your wallet anywhere other than https://t.co/Xo96Hqmjm3.

Only trust links from this account.

[Drift Foundation @DriftFDN]

Recovery efforts continue with zeroShadow and law enforcement. Recovered funds will support the Recovery Pool.

Latest recovery update: https://t.co/p0C8kic1es

[Drift Foundation @DriftFDN]

Drift Recovery Update

An update on the ~$295.4M taken from Drift users on 1 April, and where recovery efforts stand.

Drift Foundation will continue pursuing efforts to track, trace, and recover stolen funds. Recovered funds, whether they come back through a freeze, bounty, or through law enforcement, shall be directed into the DFX recovery pool.

Mandiant, zeroShadow, and SEAL 911 were brought in to investigate and trace the funds. Mandiant identified the attacker as UNC6862, a North Korean threat group. Since April, zeroShadow has tracked the stolen funds, including the laundering that began in July, and has shared its findings with law enforcement.

—

Where the funds are

The stolen funds were bridged to Ethereum, ~130,259 ETH across four wallets. Three of those four wallets have not moved and currently hold 107,165 ETH. On 23 July, one of the wallets sent about 23,094 ETH into Tornado Cash.

Working together with zeroShadow and law enforcement, the Foundation continues to track and flag every withdrawal as it appears, and monitor all wallets around the clock.

Some of those stolen funds have been transferred across multiple blockchains and jurisdictions, making the process of recovering and returning frozen funds complex and time-consuming.

—

Frozen funds

About $9.2M of stolen funds has been frozen so far, after the attacker moved them through Tornado Cash in August.

Recovering frozen funds involves law enforcement and is a process that takes time. We are actively working on this and will share updates as soon as there is progress.

—

DRIFT token

The Foundation is also evaluating the best path forward for the DRIFT. Foundation's priority remains asset recovery and establishing the token's future pathway within the broader DRIFT ecosystem.

—

Bounty Program

In collaboration with Bybit, the Foundation has launched a public bounty program: a 10% bounty on any successfully recovered funds. The program is listed publicly to maximize participation from white hats, security researchers, and the broader ecosystem.

https://t.co/9UXZ69BaWp

—

A word of caution: The Foundation will never message you directly about recovered funds, ask you to connect a wallet, or ask for a fee. Anyone who does this is not from the Drift Foundation. Follow official channels for official updates.

Foundation will share the next update when there is further progress to report.

[Drift Foundation @DriftFDN]

We will never DM you, ask for a fee, or ask you to connect your wallet anywhere other than https://t.co/Xo96Hqmjm3.

Only trust links from this account.

[Drift Foundation @DriftFDN]

Recovery efforts continue with zeroShadow and law enforcement. Recovered funds will support the Recovery Pool.

Latest recovery update: https://t.co/p0C8kic1es

[Drift Foundation @DriftFDN]

Drift Recovery Update

An update on the ~$295.4M taken from Drift users on 1 April, and where recovery efforts stand.

Drift Foundation will continue pursuing efforts to track, trace, and recover stolen funds. Recovered funds, whether they come back through a freeze, bounty, or through law enforcement, shall be directed into the DFX recovery pool.

Mandiant, zeroShadow, and SEAL 911 were brought in to investigate and trace the funds. Mandiant identified the attacker as UNC6862, a North Korean threat group. Since April, zeroShadow has tracked the stolen funds, including the laundering that began in July, and has shared its findings with law enforcement.

—

Where the funds are

The stolen funds were bridged to Ethereum, ~130,259 ETH across four wallets. Three of those four wallets have not moved and currently hold 107,165 ETH. On 23 July, one of the wallets sent about 23,094 ETH into Tornado Cash.

Working together with zeroShadow and law enforcement, the Foundation continues to track and flag every withdrawal as it appears, and monitor all wallets around the clock.

Some of those stolen funds have been transferred across multiple blockchains and jurisdictions, making the process of recovering and returning frozen funds complex and time-consuming.

—

Frozen funds

About $9.2M of stolen funds has been frozen so far, after the attacker moved them through Tornado Cash in August.

Recovering frozen funds involves law enforcement and is a process that takes time. We are actively working on this and will share updates as soon as there is progress.

—

DRIFT token

The Foundation is also evaluating the best path forward for the DRIFT. Foundation's priority remains asset recovery and establishing the token's future pathway within the broader DRIFT ecosystem.

—

Bounty Program

In collaboration with Bybit, the Foundation has launched a public bounty program: a 10% bounty on any successfully recovered funds. The program is listed publicly to maximize participation from white hats, security researchers, and the broader ecosystem.

https://t.co/9UXZ69BaWp

—

A word of caution: The Foundation will never message you directly about recovered funds, ask you to connect a wallet, or ask for a fee. Anyone who does this is not from the Drift Foundation. Follow official channels for official updates.

Foundation will share the next update when there is further progress to report.

[Drift Foundation @DriftFDN]

Drift Recovery Update

An update on the ~$295.4M taken from Drift users on 1 April, and where recovery efforts stand.

Drift Foundation will continue pursuing efforts to track, trace, and recover stolen funds. Recovered funds, whether they come back through a freeze, bounty, or through law enforcement, shall be directed into the DFX recovery pool.

Mandiant, zeroShadow, and SEAL 911 were brought in to investigate and trace the funds. Mandiant identified the attacker as UNC6862, a North Korean threat group. Since April, zeroShadow has tracked the stolen funds, including the laundering that began in July, and has shared its findings with law enforcement.

—

Where the funds are

The stolen funds were bridged to Ethereum, ~130,259 ETH across four wallets. Three of those four wallets have not moved and currently hold 107,165 ETH. On 23 July, one of the wallets sent about 23,094 ETH into Tornado Cash.

Working together with zeroShadow and law enforcement, the Foundation continues to track and flag every withdrawal as it appears, and monitor all wallets around the clock.

Some of those stolen funds have been transferred across multiple blockchains and jurisdictions, making the process of recovering and returning frozen funds complex and time-consuming.

—

Frozen funds

About $9.2M of stolen funds has been frozen so far, after the attacker moved them through Tornado Cash in August.

Recovering frozen funds involves law enforcement and is a process that takes time. We are actively working on this and will share updates as soon as there is progress.

—

DRIFT token

The Foundation is also evaluating the best path forward for the DRIFT. Foundation's priority remains asset recovery and establishing the token's future pathway within the broader DRIFT ecosystem.

—

Bounty Program

In collaboration with Bybit, the Foundation has launched a public bounty program: a 10% bounty on any successfully recovered funds. The program is listed publicly to maximize participation from white hats, security researchers, and the broader ecosystem.

https://t.co/9UXZ69BaWp

—

A word of caution: The Foundation will never message you directly about recovered funds, ask you to connect a wallet, or ask for a fee. Anyone who does this is not from the Drift Foundation. Follow official channels for official updates.

Foundation will share the next update when there is further progress to report.

[David @davijlu]

We are in the process of changing @x handles.

Please do not interact with @DriftProtocol and report it.

[Velocity @VelocityDEX]

The Recovery Token and Insurance Fund Claim Checker is now live.

Affected users can now connect their wallet to view their Recovery Token allocation and Insurance Fund claim eligibility.

[Tracy @tracybbd]

CLARIFICATION: DIP-10 is unrelated to the Insurance Fund.

It is specifically about the remaining spot assets in the Borrow/Lend pool, and proposes to authorise Drift Foundation to convert those assets into stablecoins to seed the recovery pool at launch.

Affected users will receive recovery tokens representing their verified loss, which can be claimed against the recovery pool as it grows.

[Drift Foundation @DriftFDN]

Vote now:
https://t.co/s6RmXpKNTo

[Drift Foundation @DriftFDN]

Vote for DIP-10: Treatment of Remaining Asset in Borrow Lend is currently live.