Drift

Drift was one of the main perpetual futures exchanges on Solana: traders opened leveraged long and short positions from their own wallets, with one margin account covering perpetuals, spot collateral and borrowing and lending. On 1 April 2026 an attacker emptied most of its vaults. The team shut the protocol, rebuilt it, and relaunched it in September 2026 under a new name, Velocity, at velocity.exchange.

Velocity is not a separate company that bought Drift's users. Its own documentation says the program is forked from the Drift Protocol v2 codebase, and its website carries a "Drift Recovery" section that sends affected users to dfx.drift.trade. The old domain, drift.trade, still hosts the incident updates and links to drift.foundation for governance.

According to Solana Compass, Drift was started by Cindy Leow and Chris Heaney, with two further co-founders known by their X handles. Leow announced on 29 September 2026 that she was stepping down. She named a co-founder to lead asset recovery and law-enforcement work with the Foundation and a former Helium engineer to lead the rebuilt contracts; Drift's own June 2026 update had already named Noah Prince as Head of Protocol. Velocity does not publish the legal entity behind its interface in a form we could read today: its terms of use are drawn as an image rather than text.

The attack did not exploit a bug in the trading code. It went through the keys that controlled the protocol. Drift's own updates say the durable-nonce feature on its multisig was central to how the attack was carried out, and that the forensic firm Mandiant attributed it to UNC6862, a North Korean group. Drift lists $295,706,374.93 of assets withdrawn during the incident.

TRM Labs, a blockchain analytics firm, describes the sequence in more detail. Staging began on 11 March with funds from Tornado Cash. Over the following weeks the attacker created a token, gave it a price history of about $1 through wash trading on a tiny pool, and persuaded signers on Drift's Security Council multisig to pre-sign transactions that looked routine but contained admin actions. TRM says that on 27 March Drift moved the council to a 2-of-5 threshold with no timelock. On 1 April the pre-signed transactions listed the fake token as collateral and raised withdrawal limits, and 31 withdrawals in about 12 minutes took USDC, JLP and other assets. Most of it was bridged to Ethereum within hours.

Drift says its Insurance Fund was not affected. The fund's depositors were able to withdraw from 7 July 2026 through dfx.drift.trade.

Affected users were not refunded in full. Each verified USDT of loss became one DFX, a transferable Solana token with a fixed supply of 299,500,810.998. Claims opened on 1 October 2026 and must be made from the wallet that controlled the Drift account on 1 April 2026; unclaimed DFX is burned after 00:00 UTC on 1 January 2028.

A DFX holder can burn it at any time for a share of the recovery pool: pool balance divided by DFX outstanding. When claims opened the pool held about 3.1 million USDT, so an early redeemer received about 0.0104 USDT per DFX, and redeeming is final. DFX also trades on Raydium at whatever price the market sets, which Drift says it does not control.

The pool is meant to grow from four sources:

• A daily share of Velocity's net protocol revenue: 60% of the first 30,000 USDT, 70% from 30,000 to 100,000 USDT, and 90% above that.
• A commitment of up to 127.5 million USDT from Tether, part of a package that Drift says also includes a revenue-linked credit facility and loans to market makers.
• Commitments of up to 20 million USDT from other partners.
• Any stolen funds that are recovered.

Deposits into the pool stop once it has received the total of verified losses. The word "up to" matters in the Tether line: the updates describe the amounts as commitments and proposals, not as money already paid in. Tether's role is also commercial, since the relaunch moved settlement to its stablecoin; see our page on Tether for how USDT itself works.

Velocity is a perpetual futures exchange and money market on Solana. Each subaccount holds one pool of collateral that backs its positions and can be lent out to borrowers at the same time. USDT counts at full value as margin; wBTC, wETH and SOL count at published discounts. Trading is perpetuals only, and spot markets exist for collateral and lending.

Prices for margin, liquidation and funding come from Pyth feeds. The docs set out how stale or volatile a price can be before it is rejected, and they warn that a liquidation can be triggered by any price within 50% of the five-minute average. Liquidations are partial and step up, rather than closing a whole position at once.

If a liquidated account still owes money, the debt is covered first by that market's own insurance fee pool and then by a shared Insurance Fund, capped by market tier: up to $100 million for tier A markets and nothing at all for speculative and isolated tiers. Anything left over is spread across other users. Velocity says its central order book and a separate market-making pool are still being built.

Fees depend on 30-day trading volume, counting both taker and maker volume. The schedule below is the baseline for the SOL, BTC and ETH perpetuals; the docs say other markets can be priced above or below it, and that the admin can change the rates.

Referred users get 5% off the taker fee. Spot swaps and spot market deposits carry no trading fee, and the docs mention no deposit or withdrawal fee beyond Solana network costs. Of the taker fee left after rebates and rewards, 15% goes to the Insurance Fund, 15% to the market-making pool and 70% to the protocol, and part of that protocol share then flows to the DFX recovery pool.

OtterSec audited the post-fork Velocity program between 19 June and 20 July 2026 and issued its final report on 3 September. It recorded 154 findings: no critical, 41 high, 109 medium, one low and three informational. Velocity says every high finding is fixed in the deployed code. The older Drift v2 code it forked had audits by Trail of Bits (late 2022, with a fix review in January 2023) and Neodyme (2024), which do not cover anything added since. Asymmetric Research advised on operational security, and Solana Compass reports a Solana Foundation review still in progress.

The program is not open source yet; Velocity says the code will be published after the audit report is finalised. Its admin-keys page describes three tiers of keys, with routine parameter changes behind a timelock and a separate pause key, but it says outright that it does not publish who holds the keys or the signing thresholds. Drift's April update said durable nonces would be disabled for multisig signers and timelocks enforced.

A bug bounty pays up to 10% of the value at risk for critical program bugs, with a minimum of $10,000 and a maximum of $100,000, and smaller fixed ranges for lower tiers. Reports go to [email protected].

Using Velocity means trusting a young deployment run by a team that has just lost most of its users' money through key management. The main risks:

• Admin control: margin ratios, fee splits and market status can all be changed by admin keys whose holders are not published.
• Unpublished code: the deployed program cannot yet be checked against public source.
• Leverage and oracles: a wrong or late Pyth price can liquidate a solvent account, and up to 20x leverage magnifies small moves.
• Shared collateral: deposits are lent out, so a profitable trader can wait for settlement and a large withdrawal can be refused when a market is near its limit.
• Recovery uncertainty for DFX holders: the payout depends on future revenue and on pledged money being paid.

Velocity is used from a Solana wallet at app.velocity.exchange. There is no account sign-up; you connect a wallet, deposit USDT or another accepted asset into a subaccount, and trade. Velocity's documentation includes a migration guide for developers who built on Drift's SDK.

Withdrawing is a transaction from your wallet, but it can be refused even when your account is healthy. Each spot market caps how far its deposits can fall in a rolling 24-hour window, by default to about 75% of the average, so very large withdrawals may have to wait. Small depositors who never withdrew more than they put in have a limited exception. Realised profit also sits in a market's profit-and-loss pool until it is settled, so a closed winning position does not instantly raise your withdrawable balance.

Former Drift users have two separate routes: DFX claims for losses, and a distinct claim for Insurance Fund deposits, both at dfx.drift.trade. For a wider view of other venues, see how Drift compares with other perpetual exchanges.

Dates below come from Drift's update archive and the incident reports cited on this page.

• May 2022: an incident on Drift's first version, recorded by DefiLlama at about $14.5 million.
• 16 June 2022: Drift v2 announced.
• July 2025: a new trading fee structure; December 2025: Drift v3 announced.
• 1 April 2026: the exploit; deposits and withdrawals halted.
• 16 April 2026: recovery plan with Tether funding and a move from USDC to USDT announced.
• 3 June 2026: Mandiant attribution published; new Head of Protocol named.
• 7 July 2026: Insurance Fund deposits made withdrawable.
• September 2026: Velocity opens to the public; co-founder Cindy Leow steps down on 29 September.
• 1 October 2026: DFX claims and redemptions open.