# Drift Protocol Recovery: DFX Redemptions and Velocity Revenue > Drift recovery tracker after the April 2026 exploit: the USDT recovery pool, what one DFX redeems for, DFX burned and Velocity revenue swept into the pool. Markdown copy of https://voltfincrypto.com/apps/drift-protocol-recovery-dfx **Question:** How much is in Drift's recovery pool, what does one DFX redeem for and how much has been paid out? - Kind: Dashboard in Voltfin Vantage - Topic: [DeFi](https://voltfincrypto.com/topics/defi) - Chains: Solana, Ethereum - Status: Planned. The data is not published yet, so this page states no figure; each figure will open its receipt when it is. Drift was a Solana perpetuals and margin exchange until 1 April 2026, when an attacker used a compromised admin key to change the exchange's settings and drain its vaults, in an exploit later tied to North Korea. The exchange has since relaunched as Velocity, a perpetuals-only venue that settles in USDT, and the Drift Foundation issued DFX, a recovery token: one DFX for each USDT of verified loss. Holders can redeem DFX for a share of a recovery pool funded by protocol assets, a sweep of Velocity's net revenue and outside commitments, or hold it while the pool grows. Each redemption burns the DFX it pays, so later deposits are shared among fewer tokens. This dashboard follows the pool's USDT and what one DFX redeems for. It also counts the DFX claimed, redeemed and still outstanding, and what flows into the pool each day. It also follows the funds taken in the exploit, from the attacker wallets on Solana and Ethereum through the amounts bridged and mixed to any frozen funds released to the pool, with each figure linked to its transactions. ## Blueprint ### Recovery The pool, what one DFX redeems for and where DFX stands. - **Recovery pool** (USDT): USDT held by the recovery pool at the latest day's last slot. - **One DFX redeems for** (USDT): What redeeming one DFX pays at the latest slot, read from the redemption program. - **DFX outstanding** (DFX): DFX claimed and not yet redeemed at the latest slot. - **Share of DFX redeemed** (%): DFX burned through redemptions as a share of all DFX claimed so far. - **Money in and out of the pool** (USDT): Daily deposits into the pool by source (protocol assets, revenue sweeps and outside funds) against redemptions paid out. - **DFX redemption value by day** (USDT): What one DFX redeemed for at each day's end since claims opened. ### Exploit The funds taken on 1 April 2026 and where they went. - **Taken in the exploit** (USD): Value moved out of Drift's vaults in the attack transactions of 1 April 2026, at prices at those blocks. - **Still in attacker wallets** (USD): Value still held by the labelled attacker addresses on Solana and Ethereum at the latest read. - **Where the funds went** (USD): Stolen value split by where it sits now: held, bridged, mixed, frozen or returned. - **Attacker flows by month** (USD): Value leaving attacker wallets each month, by the kind of destination it went to. Filters: Period (Since claims opened, or the last 7 or 30 days). ## How it will be measured - The recovery pool is the USDT balance of its on-chain account at each day's last slot, and deposits into it are classed by sender: protocol assets, Velocity revenue sweeps and outside contributions. - What one DFX redeems for is read from the redemption program at each slot and checked against the pool's USDT and the DFX outstanding; redemptions and burns come from the program's transactions and DFX's supply. - Velocity's daily net revenue is read from its fee accounts, and the amount swept to the pool from the sweep transactions, so the two can be compared day by day. - Exploit flows follow the attacker addresses named in Drift's incident reports through bridges and mixers on Solana and Ethereum, and stop at labelled addresses. ## Data it needs - `security_incidents` (to build): A registry of exploits, hacks and rug pulls: date, chain, protocol, attack type, amount lost and the transactions involved. - `address_labels` (to build): Labels for known addresses: exchanges, bridges, protocols, funds, treasuries, sanctioned addresses and known attackers. - `protocol_revenue_daily` (to build): Fees users paid to each protocol and the part kept by the protocol or its token holders, per protocol and day, including buybacks. - `perps_markets_daily` (to build): Volume, open interest, funding rates and fees per market on on-chain perpetual exchanges, per day. - Source: The recovery pool's USDT account balance and incoming transfers at each day's last slot - Source: DFX mint, supply and burn records, and the redemption program's transactions - Source: Velocity fee accounts and the revenue sweep transactions into the pool - Source: Attacker addresses from Drift's incident reports and their transfers on Solana and Ethereum - Source: The Drift Foundation's published recovery figures, recorded with their source ## Questions ### What happened to Drift Protocol? On 1 April 2026 an attacker with a compromised admin key changed Drift's settings and drained user funds from its vaults. Drift paused, published a recovery plan and later relaunched its exchange as Velocity, trading perpetuals only and settling in USDT. ### What is the DFX token? Drift's recovery token. Each user with a verified loss can claim one DFX per USDT lost. DFX can be redeemed for a share of the recovery pool, which burns it. It can also be sold to someone else or held while more money reaches the pool. ### How much does one DFX redeem for? It changes as money enters the pool and DFX is burned, so the dashboard reads it at the latest slot rather than quoting a fixed rate. Early redemptions paid a small fraction of each dollar lost, and redeeming gives up any later payout on the DFX redeemed. ### Is Velocity the same as Drift? Velocity is the exchange Drift relaunched after the exploit, trading perpetuals only and settling in USDT. A share of its net revenue is swept into the recovery pool, which ties what DFX redeems for to Velocity's trading. ### When do DFX claims close? Claims for verified losses opened on 1 October 2026 and close on 1 January 2028, according to the Drift Foundation. Insurance Fund stakers have a separate claim process, which this dashboard does not cover. ### Where did the stolen funds go? Much of the stolen value was bridged to Ethereum, and some has since moved through Tornado Cash. The exploit page follows each attacker wallet and marks funds frozen by issuers or exchanges, which reach the pool only once they are released. ## Glossary - **DFX**: Drift's recovery token, one per USDT of verified loss, redeemable for a share of the recovery pool. - **Recovery pool**: The USDT account that pays DFX redemptions, funded by protocol assets, revenue sweeps and outside commitments. - **Revenue sweep**: The regular transfer of a share of Velocity's net revenue into the recovery pool. - **Admin key**: A key with power to change a protocol's settings; Drift's was compromised in the exploit. ## Related apps - [Crypto Hack Tracker: Exploits and Losses This Year](https://voltfincrypto.com/apps/crypto-hack-tracker) - [North Korea Crypto Hacks: Lazarus Group Theft Tracker](https://voltfincrypto.com/apps/north-korea-crypto-hacks-tracker) - [Stolen Crypto Tracker: Where Hacked Funds Went](https://voltfincrypto.com/apps/stolen-crypto-tracker) - [Biggest Crypto Hacks of All Time, Ranked](https://voltfincrypto.com/apps/biggest-crypto-hacks) - [Perp DEX Volume and Market Share by Venue](https://voltfincrypto.com/apps/perp-dex-volume-market-share) - [DeFi TVL by Chain: Total Value Locked Rankings](https://voltfincrypto.com/apps/defi-tvl-by-chain) Build it in Voltfin Studio: https://app.voltfincrypto.com/signup?next=%2F