Recovery pool
USDTUSDT held by the recovery pool at the latest day's last slot.
How much is in Drift's recovery pool, what does one DFX redeem for and how much has been paid out?
Drift's recovery pool and DFX token after the April 2026 exploit: USDT in the pool, DFX redeemed and Velocity revenue swept in.
The dashboard as it will open in Vantage. Each figure is named here and arrives with its receipt; until its data is published, its place stays empty.
The pool, what one DFX redeems for and where DFX stands.
USDT held by the recovery pool at the latest day's last slot.
What redeeming one DFX pays at the latest slot, read from the redemption program.
DFX claimed and not yet redeemed at the latest slot.
DFX burned through redemptions as a share of all DFX claimed so far.
Daily deposits into the pool by source (protocol assets, revenue sweeps and outside funds) against redemptions paid out.
What one DFX redeemed for at each day's end since claims opened.
The funds taken on 1 April 2026 and where they went.
Value moved out of Drift's vaults in the attack transactions of 1 April 2026, at prices at those blocks.
Value still held by the labelled attacker addresses on Solana and Ethereum at the latest read.
Stolen value split by where it sits now: held, bridged, mixed, frozen or returned.
Value leaving attacker wallets each month, by the kind of destination it went to.
Drift was a Solana perpetuals and margin exchange until 1 April 2026, when an attacker used a compromised admin key to change the exchange's settings and drain its vaults, in an exploit later tied to North Korea. The exchange has since relaunched as Velocity, a perpetuals-only venue that settles in USDT, and the Drift Foundation issued DFX, a recovery token: one DFX for each USDT of verified loss.
Holders can redeem DFX for a share of a recovery pool funded by protocol assets, a sweep of Velocity's net revenue and outside commitments, or hold it while the pool grows. Each redemption burns the DFX it pays, so later deposits are shared among fewer tokens. This dashboard follows the pool's USDT and what one DFX redeems for. It also counts the DFX claimed, redeemed and still outstanding, and what flows into the pool each day.
It also follows the funds taken in the exploit, from the attacker wallets on Solana and Ethereum through the amounts bridged and mixed to any frozen funds released to the pool, with each figure linked to its transactions.
Every figure will be read at a block, kept with its source and its exact read, and open a receipt anyone can re-check.
How receipts work →Chain data, with some off-chain sources
On 1 April 2026 an attacker with a compromised admin key changed Drift's settings and drained user funds from its vaults. Drift paused, published a recovery plan and later relaunched its exchange as Velocity, trading perpetuals only and settling in USDT.
Drift's recovery token. Each user with a verified loss can claim one DFX per USDT lost. DFX can be redeemed for a share of the recovery pool, which burns it. It can also be sold to someone else or held while more money reaches the pool.
It changes as money enters the pool and DFX is burned, so the dashboard reads it at the latest slot rather than quoting a fixed rate. Early redemptions paid a small fraction of each dollar lost, and redeeming gives up any later payout on the DFX redeemed.
Velocity is the exchange Drift relaunched after the exploit, trading perpetuals only and settling in USDT. A share of its net revenue is swept into the recovery pool, which ties what DFX redeems for to Velocity's trading.
Claims for verified losses opened on 1 October 2026 and close on 1 January 2028, according to the Drift Foundation. Insurance Fund stakers have a separate claim process, which this dashboard does not cover.
Much of the stolen value was bridged to Ethereum, and some has since moved through Tornado Cash. The exploit page follows each attacker wallet and marks funds frozen by issuers or exchanges, which reach the pool only once they are released.
Every major hack and exploit of the year with the amount taken, how the attackers got in and where the stolen funds sit now.
Multi-chainThefts attributed to North Korea-linked groups, what their attributed wallets still hold and how the funds move across chains.
Multi-chainEthereumBitcoinFollow a hack's stolen funds hop by hop into bridges, swap protocols, mixers and exchanges, or see what still sits in attacker wallets.
Multi-chainThe largest hacks and exploits on record, ranked by value taken at the time, with the attack type, the chain and how much came back.
Multi-chainDaily and monthly trading volume and open interest on perpetual DEXs, venue by venue, with each venue's share and how it shifts.
Multi-chainHyperliquidArbitrum+2DeFi value locked on each chain, counted once at oracle prices, with the chain ranking, Ethereum's share and the protocols behind it.
Multi-chainEthereumSolana+3Start free in Voltfin Studio: boards, tables and reports where every number opens its receipt. Tell us which data you need first and we will build it next.