Drift Opens DFX Recovery Claims Six Months After Exploit — but Initial Payouts Cover Barely 1% of Losses

The Drift Foundation has opened claims and redemptions for DFX, the recovery token created for victims of the April 1 exploit that drained the Solana-based perpetuals protocol. The announcement on Oct. 1 gives affected users their first concrete path to compensation, though the opening numbers underline how long the road back will be: initial payouts are worth roughly 1% of verified losses.

## How the DFX claim works

Eligible wallets receive one DFX token for each USDT of verified losses recorded during the incident. The total supply was fixed at approximately 299.5 million DFX at launch, and the foundation says no additional tokens will ever be minted.

The redemption rate is not fixed. Instead, each token’s payout equals the Recovery Pool’s USDT balance divided by the outstanding DFX supply. At the opening of the claim window, that formula produced a rate of about 0.0104 USDT per DFX. A claim representing 1,000 USDT in losses would therefore redeem for roughly 10.40 USDT on day one.

Holders have three options. They can redeem immediately for USDT, with the token burn and payment executing in the same transaction so that both complete or neither does. They can hold and wait for the pool to grow. Or they can transfer or trade DFX, since it is a standard Solana token with a Raydium market, although the secondary price may differ from the published redemption value.

Early redemption carries a cost: burning tokens now removes the holder’s claim on every future deposit into the pool. Drift’s own example notes that burning 10% of supply increases each remaining token’s share of future contributions by about 11%.

## What funds the recovery

The Recovery Pool is fed by several sources. The protocol’s Velocity arm commits a share of daily net protocol revenue, deposited at 00:00 UTC, on a tiered schedule: 60% of the first 30,000 USDT, 70% of revenue between 30,000 and 100,000 USDT, and 90% of anything above that. Before net protocol revenue is calculated, Velocity allocates 15% of net trading fees to the Insurance Fund and another 15% to trading capital.

Tether has committed up to 127.5 million USDT toward the relaunch and user recovery, while strategic partners have committed up to 20 million USDT more. Any stolen assets recovered through freezes, bounties or law enforcement seizures also flow into the pool, with a 10% bounty offered on successfully recovered assets and partners including Bybit supporting the effort.

The May 5 recovery plan set a cumulative funding target of 299,426,725.97 USDT equivalent — slightly above the total supply — meaning that if funding runs to completion, remaining tokens become redeemable at full value or better.

## Claims require the April 1 wallet

For the initial claim, users must connect the wallet that controlled their Drift account on April 1, hold a small SOL balance for fees, and accept the DFX terms before approving the transaction. The claim window runs until 00:00 UTC on Jan. 1, 2028, after which all unclaimed tokens will be permanently burned.

The recovery methodology recorded spot and perpetual positions when the protocol paused at 18:31:47 UTC on April 1, but used prices from 16:06 UTC — before the attack began — to avoid valuing balances at distorted incident prices. Redemptions, by contrast, can be made from any wallet holding DFX, even if the tokens have moved from the original claiming address.

Drift also confirmed that its Insurance Fund remains intact, since it covers trading-related bankruptcies rather than exploit losses. Those deposits became available for withdrawal in July and are handled separately from the DFX process.

## Background: a months-long social engineering campaign

The April exploit, which drained roughly 280 million USDT according to protocol estimates, was the endgame of what Drift described as a months-long social engineering operation. In its investigation, the protocol said attackers posed as representatives of a quantitative trading firm, approaching contributors around October 2025 and building trust through repeated meetings at industry events before distributing malicious links and tools.

The style mirrors other high-profile compromises attributed by investigators to North Korean-linked groups, including the 1.5 billion USDT Bybit theft in February 2025 that the FBI publicly attributed to North Korean actors.

On-chain, the trail has occasionally stirred. A wallet associated with the Drift exploit moved 23,095.1 ETH — about 44.4 million USDT at the time — through Tornado Cash on July 23 after roughly three months of inactivity, according to Etherscan records and monitoring attributed to PeckShield.

## What it means for users

For affected traders, the opening of claims resolves months of uncertainty about mechanics, if not about ultimate recovery. The structure rewards patience: holders who wait capture every future revenue deposit, recovered asset and partner contribution, while early redeemers lock in a fraction of a cent per token.

The practical takeaway is that DFX is best understood as a claim on a growing pool rather than a tradeable asset with fundamental value of its own. Its redemption value rises mechanically as funding accumulates and supply burns, and the Jan. 1, 2028 deadline gives the foundation more than a year of revenue capture before unclaimed tokens are removed entirely.

Users who believe they were affected should verify their April 1 wallet, review the foundation’s published methodology, and decide consciously between liquidity today and exposure to the recovery schedule — because once tokens are burned, there is no way back into the pool.