Drift opens exploit recovery claims with initial payouts of just over 1% of user losses

DFX holders can redeem now or wait for more funding, while up to $147.5 million in partner commitments has yet to appear in the recovery pool.

Ecosystems•October 2, 2026, 1:10PM EDT
Drift opens exploit recovery claims with initial payouts of just over 1% of user losses

Quick Take

  • Redeeming DFX burns the tokens and forfeits future payouts tied to them.
  • About $9.2 million in stolen funds has been frozen, but returning it requires a law enforcement order.
Advertisement

Decentralized exchange Velocity, formerly Drift, has opened claims for users who lost funds due to its April exploit, allowing them to collect recovery tokens tied to their losses.

The platform said on Thursday that users can claim one DFX token for every USDT lost. Holders then have the option of redeeming and burning their DFX for USDT from Drift's recovery pool, selling them on the secondary market, or holding them to wait for more recovery funding.

The latter option will theoretically get a user closer to full reimbursement, because as tokens are burned, newer deposits are divided among fewer DFX.

For now, each DFX can only be redeemed for a little over 0.01 USDT, the rough equivalent of getting back one cent for every dollar lost.

On Friday, Velocity's DFX redemption and recovery dashboard showed that 216,480 DFX had been redeemed for roughly 2,250 in USDT payouts. The total pool stands at 3.11 million USDT, comprised of protocol assets. Velocity will also sweep between 60% and 90% of its net protocol revenue into the recovery pool, though after the first day, that has amounted to just 31 USDT.

The dashboard had not yet recorded a contribution from Tether, which committed up to $127.5 million to support the relaunch and user recovery. Also not yet reflected was the up to $20 million pledged by strategic partners.

Asset recovery updates

In a Sept. 30 update, the Drift Foundation said that roughly $295.4 million was stolen in the April 1 attack. Cybersecurity firm Mandiant identified the hacker as UNC6862, a "North Korean threat group."

The stolen assets were bridged to Ethereum, with three attacker wallets still holding 107,165 ETH worth nearly $286 million. A fourth wallet previously moved 23,094 ETH through crypto mixer Tornado Cash in July.

About $9.2 million of the stolen funds have been frozen so far, according to the foundation, which will ideally go into the DFX recovery pool once cleared by law enforcement.