Drift Protocol Says Insurance Fund Deposits Remain Safe After $280M Exploit

, TLDR

• Drift said its Insurance Fund was not affected by the April exploit.
• Insurance Fund stakers can withdraw shares once Drift comes back online.
• The exploit caused estimated losses of about $280M to $286M.
• Drift said the protocol paused before liquidation or bankruptcy losses occurred.
• Recovery tokens will represent verified user losses in Drift’s recovery plan.

Drift Protocol said users who staked assets into its Insurance Fund will be able to withdraw their shares once the Solana-based trading platform returns online after a major exploit in April.

The protocol said in an update on X that the Insurance Fund “was and remains unaffected by the exploit.” Drift said the platform was paused before losses could move through its normal liquidation or bankruptcy processes, which prevented the fund from being used as part of the loss sequence.

The clarification follows weeks of questions from users after the attack, which forced Drift offline and led to losses estimated at about $280 million to $286 million. Security researchers described the breach as a privileged-access compromise involving a compromised administrator key, rather than a flaw in Drift’s smart contracts.

Insurance Fund Depositors Await Withdrawals

Drift’s Insurance Fund is designed to support exchange solvency when leveraged positions become bankrupt and liquidations do not fully cover losses. Users can stake assets such as USDC, SOL, BTC or ETH into asset-specific pools and earn a share of trading and liquidation fees.

Since the platform pause on April 1, Insurance Fund stakers have not been able to access their capital. Drift said those users will be able to withdraw their corresponding shares after the protocol is restored.

The protocol also said its documentation allows users to unstake from the Insurance Fund, though withdrawals are subject to a 13-day cooldown period. Drift has not yet provided a final relaunch date.

The latest update attempts to separate user-owned Insurance Fund deposits from protocol-owned reserves. Drift said protocol-owned Insurance Fund assets may still be used to support a healthy relaunch and user recovery plan.

Recovery Plan Faces User Scrutiny

Drift’s recovery framework has drawn criticism from parts of its community. A governance proposal known as DIP-10 suggested converting remaining borrow and lend pool assets into USDT to support a recovery pool.

Some users raised concerns about centralized discretion, settlement fairness and whether user-linked funds could be used to absorb exploit-related losses. Others questioned why governance was considering asset conversions before full details of outside recovery support were disclosed.

Drift said affected wallets will receive recovery tokens tied to verified losses. Each token is intended to represent a $1 claim on the recovery pool. The pool is expected to begin with about $3.8 million from remaining protocol assets converted into USDT.

The protocol said redemptions will open after the recovery pool exceeds $5 million. Drift plans to grow the pool through quarterly exchange revenue, a reported commitment of up to $127.5 million from Tether and as much as $20 million from strategic partners.

Users who redeem early would receive a pro-rata share of the pool at that time and forfeit the rest of their claim. Consequently, Drift said users who wait may receive a higher recovery price if the pool grows.

Drift Prepares for Relaunch

Drift Protocol has said it aims to restart in the second quarter of 2026 as a leaner exchange focused on perpetual futures. The platform’s recovery process remains tied to governance votes, capital support and community confidence.

The protocol said it plans to publish relevant on-chain addresses so users can track how protocol-owned capital is used during the restart. That step is intended to give the community more visibility into recovery fund movements.

Drift’s total value locked has fallen sharply since the exploit. Data cited in the source material placed TVL near $243 million, down from more than $550 million before the attack. The DRIFT token has also traded near record lows, reflecting pressure on the project after the breach.

The exploit has become a wider debate over DeFi recovery standards, insurance fund treatment and governance transparency after security incidents. For Drift users, the main unresolved issues are the relaunch timeline, redemption terms and the final size of the recovery pool.

Drift’s latest statement confirms that Insurance Fund depositors are expected to regain access to their shares after the protocol returns online, while the broader compensation process for affected users remains under review.