{"id":3902,"date":"2026-05-05T19:21:18","date_gmt":"2026-05-05T19:21:18","guid":{"rendered":"https:\/\/www.europesays.com\/korea\/3902\/"},"modified":"2026-05-05T19:21:18","modified_gmt":"2026-05-05T19:21:18","slug":"drift-outlines-a-recovery-plan-for-users-after-295-million-dprk-linked-exploit","status":"publish","type":"post","link":"https:\/\/www.europesays.com\/korea\/3902\/","title":{"rendered":"Drift outlines a recovery plan for users after $295 million DPRK-linked exploit"},"content":{"rendered":"<p>Drift Protocol <a href=\"https:\/\/www.drift.trade\/updates\/recovery-plan-for-affected-users\" target=\"_blank\" rel=\"nofollow noopener\">announced Tuesday the implementation<\/a> of a recovery plan for users affected by a $295 million exploit on April 1, which it attributed to the North Korea state-backed DPRK hacking group identified by forensic firm Mandiant.<\/p>\n<p>The attack led the protocol to suspend trading and borrowing immediately after the exploit. Drift said \u201cthe majority of stolen assets remain traceable and contained with limited successful off-ramping by the attacker,\u201d with about 130,259 ETH (roughly $31 million) concentrated across four monitored wallets.<\/p>\n<p>Drift\u2019s statement explains that the recovery framework centers on issuing a token representing verified user losses. \u201cEach recovery token represents $1 of verified loss,\u201d Drift said, adding that holders would be able to redeem based on the value of a recovery pool funded over time.<\/p>\n<p>That pool starts with roughly $3.8 million in remaining protocol assets and is expected to grow through exchange revenue, up to $127.5 million in support from Tether tied to performance, and up to $20 million from partners, Drift said. The pool will accrue until it matches total losses of about $295.4 million, at which point tokens can be redeemed at full value, it added.<\/p>\n<p>Drift also said some funds have already been frozen, including about $3.36 million in USDC, while additional assets remain delayed in cross-chain transfers. Legal efforts to seize and reissue funds are ongoing, it said. The protocol also launched a public bounty offering 10% of recovered assets.<\/p>\n<p>Drift plans to relaunch in the second quarter as a \u201csecurity-first\u201d exchange with changes including new multisig controls, time-locked operations, key rotation and reduced product scope focused on perpetuals trading.<\/p>\n<p>\u201cThe Drift team is taking considered measures to ensure that users are made whole,\u201d the team said, adding that final decisions will be subject to governance votes.<\/p>\n<p>Drift\u2019s recovery plan announcement comes a week after <a href=\"https:\/\/www.coindesk.com\/tech\/2026\/04\/27\/industry-leaders-are-pouring-hundreds-of-millions-into-a-rescue-plan-for-aave-users-after-massive-crypto-hack\" rel=\"nofollow noopener\" target=\"_blank\">Aave said it was spearheading<\/a> a coordinated DeFi recovery effort to rescue Kelp DAO, the second largest DeFi exploit this year, which was also carried out by North Korean-backed hackers. The so-called Lazarus group drained nearly $280 million. In this case, Aave has been able to garner span donations, deposits, and credit lines from across the crypto space.<\/p>\n","protected":false},"excerpt":{"rendered":"Drift Protocol announced Tuesday the implementation of a recovery plan for users affected by a $295 million exploit&hellip;\n","protected":false},"author":2,"featured_media":3903,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[3579,31,34],"class_list":["post-3902","post","type-post","status-publish","format-standard","has-post-thumbnail","category-north-korea","tag-hack","tag-korea","tag-north-korea"],"_links":{"self":[{"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/posts\/3902","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/comments?post=3902"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/posts\/3902\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/media\/3903"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/media?parent=3902"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/categories?post=3902"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/tags?post=3902"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}