Key facts
- Users can claim one DFX token for every USDT of verified loss from the April 1, 2026 exploit.
- The initial redemption rate is approximately one cent on the dollar, based on the Recovery Pool's current balance.
- The claim window for DFX tokens is open until January 1, 2028.
- Unclaimed DFX tokens will be burned after the claim deadline.
- The exploit was attributed to a social-engineering campaign compromising private keys, not a smart-contract bug.
- North Korean state-linked actors have been tied to the attack.
The Drift Foundation has launched its DFX recovery token, enabling users who suffered losses in the April 1, 2026 exploit to claim compensation. Each DFX token is issued at a one-to-one ratio with verified USDT losses. The Recovery Pool, currently holding approximately 3.11 million USDT, dictates an initial redemption rate of about one cent on the dollar. This rate is subject to change as the pool grows and secondary market prices fluctuate.
Users must connect the wallet used for their Drift account on April 1, 2026, to access their allocated DFX tokens. Redemption involves burning the DFX tokens, which permanently removes them from circulation. Early redeemers secure the current fractional rate but forgo potential future gains if the pool's value increases. The claim period extends until January 1, 2028, after which any unclaimed tokens will be burned, potentially increasing the redemption value for remaining token holders.
The DFX token operates as a standard Solana SPL asset with a fixed supply of roughly 299.5 million. It is available for trading on secondary markets like Raydium, where its price may deviate from the published pool ratio.
Drift clarified that the April 1 exploit was the result of a prolonged social-engineering campaign that compromised private keys, rather than a smart-contract vulnerability. The Recovery Pool's growth is fueled by multiple sources, including a tiered share of Velocity's daily net protocol revenue, commitments from Tether (up to 127.5 million USDT), and pledges from strategic partners (up to 20 million USDT). Additionally, any recovered funds from asset freezes, bounties, or law enforcement actions will be added to the pool. The attack has been linked to North Korean state-linked actors, consistent with broader campaigns that have prompted international warnings.