The Drift Foundation has opened DFX recovery claims and redemptions for victims of its April 1 exploit, with roughly 3.11 million USDT available and initial payouts near 1% of verified losses.
Summary
- Eligible wallets receive one DFX token for each USDT of verified losses from the exploit.
- Initial redemptions pay about 0.0104 USDT per DFX, with redeemed tokens permanently burned.
- Recovery funding includes Velocity revenue, Tether support, partner capital, and any recovered stolen assets.
- The claim window closes on Jan. 1, 2028, when unclaimed DFX tokens will be burned.
The Drift Foundation announced on Oct. 1 that affected users can claim their allocated tokens, redeem them for USDT, or retain their share of future recovery funding. Its launch terms set the total supply at approximately 299.5 million DFX, with no additional tokens to be minted.
DFX redemptions pay a fraction of verified losses
Under the foundation’s formula, each token’s redemption amount equals the Recovery Pool’s USDT balance divided by the outstanding DFX supply. Drift puts the opening rate at about 0.0104 USDT per token, meaning a claim representing 1,000 USDT of losses would initially redeem for approximately 10.40 USDT.
For holders who redeem, Drift says the token burn and USDT payment happen in the same transaction, so both complete or neither does. The foundation’s instructions make redemptions final and round payouts down to the nearest 0.000001 USDT.
According to the launch terms, holders can also transfer DFX or trade it on Raydium because it is a standard Solana token. The published redemption amount determines the pool payout, while a secondary-market sale depends on the trading price.
In its May 5 recovery plan, Drift separated the recovery asset from its DRIFT governance token and set a cumulative funding target of 295,426,725.97 USDT. The plan said revenue contributions would stop once total inflows matched that amount, with remaining tokens redeemable at full value or more.
Drift’s launch explanation says early redemption removes the holder’s claim to subsequent deposits. In its example, burning 10% of the supply gives each remaining token about 11% more of every future contribution.
Claims require the wallet recorded on April 1
For the initial claim, the foundation requires users to connect the wallet that controlled their Drift account on April 1. Its instructions also require a small SOL balance for network fees and acceptance of the DFX terms before approving the claim transaction.
Under the May recovery methodology, Drift recorded spot and perpetual positions when the protocol paused at 18:31:47 UTC on April 1. The same document used prices from 16:06 UTC, before the attack began, to avoid valuing balances at prices distorted during the incident.
According to the October instructions, redemption can use any wallet holding DFX, even if the tokens have moved from the original claiming address. The claim window ends at 00:00 UTC on Jan. 1, 2028, and the foundation says all unclaimed tokens will then be permanently burned.
In a separate update, Drift said its Insurance Fund remained intact because it covers trading-related bankruptcies rather than the exploit’s losses. A July 7 addition to that update made those deposits available for withdrawal, while the October portal instructions identify Insurance Fund claims as separate from DFX.
Velocity revenue funds daily recovery deposits
Under Drift’s new funding schedule, Velocity sends a share of daily net protocol revenue to the pool at 00:00 UTC. The foundation assigns 60% of the first 30,000 USDT, 70% of revenue between 30,000 and 100,000 USDT, and 90% above 100,000 USDT.
According to the announcement, each percentage applies only to revenue within its own band. Before calculating net protocol revenue, Velocity allocates 15% of net trading fees to its Insurance Fund and another 15% to trading capital, leaving 70% as net protocol revenue.
The foundation says Tether has committed up to 127.5 million USDT for relaunch and user recovery, while strategic partners have committed up to 20 million USDT. Drift’s April framework described the support package as including a revenue-linked credit facility, an ecosystem grant and market-maker loans.
For stolen assets, Drift’s recovery framework directs funds recovered through freezes, bounties or law enforcement into the pool. Its May plan also announced a 10% bounty on successfully recovered assets, with Bybit and other partners supporting the program.
Earlier reports traced stolen funds and affected businesses
As crypto.news reported on July 24, a wallet associated with the exploit moved funds through Tornado Cash after roughly three months of inactivity. Etherscan records and monitoring attributed to PeckShield showed transfers totaling 23,095.1 ETH, valued at about $44.4 million, beginning July 23.
In April 5 coverage of Drift’s months-long social engineering campaign, the protocol said attackers posed as representatives of a quantitative trading firm and approached contributors around October 2025. Repeated meetings at industry events preceded the distribution of malicious links and tools, according to its investigation.
For U.S. law enforcement, North Korean crypto theft has also prompted public requests for industry assistance. In a February 2025 notice, the FBI attributed the separate $1.5 billion Bybit theft to North Korea and asked exchanges, infrastructure providers and blockchain analytics firms to block transactions involving identified addresses.
In a June 15 announcement covered the following day, payments platform Pyra said it would shut down after losses connected to Drift. The company canceled existing payment cards, stopped accepting new users and set Sep. 15 as the deadline for withdrawals and private-key exports.
Pyra’s closure notice said a planned web portal would handle account management, withdrawals and eventual distributions of Drift recovery tokens. At the time, the company said it had not received a token distribution timetable from Drift.
