Drift Proposes ‘Recovery Tokens’ to Repay Victims of $295 Million Hack — But the Math Could Take Years

Nearly a month after hackers drained $295 million from Drift, the Solana-based derivatives exchange has unveiled a plan to make victims whole — but the fine print suggests patience will be the price of restitution.

On Tuesday, Drift’s development team proposed issuing “recovery tokens” to users who lost funds in the April 1 breach, giving them a claim on a so-called recovery pool that will be slowly filled with future protocol revenue and contributions from outside partners, including stablecoin issuer Tether. The plan, which still requires approval from Drift tokenholders, would also relaunch the exchange as a stripped-down, “security-first” platform focused narrowly on perpetual futures trading.

“The Drift team is taking considered measures to ensure that users are made whole, and that Drift restores itself as the leading perpetuals DEX on Solana,” the developers wrote in an update posted to the exchange’s website, adding that the team had made “internal hard decisions to restructure and operate as lean as possible.”

The proposal is as much a confession of constrained resources as it is a roadmap to recovery. According to figures cited in the plan, Drift generated roughly $19 million in revenue over all of 2025. At that pace, filling a $295 million hole would take the better part of eight years — and that’s assuming Tether and other partners follow through on pledges to contribute a combined $147 million toward the effort. Drift itself proposed seeding the pool with just under $4 million in stablecoins to get things started.

For users unwilling to wait nearly a decade for full repayment, the plan offers an escape hatch: once the recovery pool reaches $5 million, tokenholders would be able to redeem their claims early, albeit at a steep discount to what they’re actually owed. Because the recovery tokens are designed to be transferable, they effectively become a tradable bet on whether Drift’s leaner business model can generate enough cash to eventually make good on its promises.

The hack itself exposed a soft spot that has become uncomfortably familiar across decentralized finance: not a flaw in smart contract code, but a breakdown in operational trust. Attackers reportedly manipulated Drift administrators into approving fraudulent transactions, draining the protocol’s funds and forcing a suspension of trading and other activity. Blockchain investigators have since pointed to North Korean state-linked hacking groups as the likely culprits — part of a pattern of Pyongyang-linked crypto heists that have siphoned hundreds of millions of dollars from exchanges and DeFi protocols in recent years.

In response, Drift says it is overhauling not just its finances but its internal security culture. Administrators will be required to follow a formal security protocol, including the use of dedicated hardware and quarterly training sessions — an acknowledgment that even well-audited code can be undone by human error or social engineering.

The rebuilt protocol will look considerably smaller in ambition than the one that existed before the hack. Drift plans to relaunch before July as, in its own words, “a leaner, perps-native exchange,” dropping its higher-yield “earn” products that resembled savings accounts and narrowing the range of collateral assets it accepts to only the most liquid, widely traded tokens. Plans for a mobile app and a new liquidity model — both unveiled just months before the attack — have been shelved indefinitely as the team redirects resources toward recovery and relaunch.

Markets, for their part, appear unconvinced that any of this changes much in the near term. Drift’s native token was trading just under 4 cents both before and after Tuesday’s announcement, suggesting investors are reserving judgment until the recovery plan clears a tokenholder vote — and, more importantly, until Drift proves it can actually generate the revenue its own math depends on.

The episode adds to a growing list of major DeFi hacks this year that have forced protocols to improvise creative, often lengthy compensation schemes rather than simply making victims whole outright. For an industry that markets itself on trustless, code-based guarantees, Drift’s recovery tokens are a reminder that when things go wrong, users are frequently left holding IOUs backed by nothing more than a promise — and a business plan that has yet to be tested.

“This will take time but the structure is in place, ecosystem partners are committed and the work is underway,” the proposal concluded. Whether that is enough to satisfy tokenholders, and eventually victims, will become clearer as the vote unfolds and Drift attempts its relaunch in the coming weeks.