The Solana-based decentralized exchange said DFX holders can either redeem and burn their tokens for USDT from a recovery pool, sell them on the secondary market, or continue holding them as additional money enters the pool. The structure effectively gives victims a choice between taking a small recovery now and retaining exposure to future recoveries and revenue generated by Drift’s rebuilt exchange, Velocity.
The mechanism follows an attack that Drift now says resulted in approximately $295.4 million of user assets being stolen. Earlier analysis of the Drift Protocol exploit identified indicators associated with North Korean threat actors before later forensic work attributed the operation to UNC6862.
How Much Can DFX Holders Recover Today?
DFX has a fixed maximum supply of approximately 299.5 million tokens, corresponding to verified losses from the April incident. The recovery pool began with roughly 3.1 million USDT, producing an initial redemption rate of about 0.0104 USDT per DFX.
That means a victim allocated 10,000 DFX for a verified 10,000 USDT loss could currently redeem the entire position for only around 104 USDT. Redeeming is irreversible: the DFX is burned in the same transaction that delivers the USDT.
The burn does not immediately increase the redemption rate because tokens and pool assets are removed proportionally. It does, however, matter for future funding. Once a holder redeems and burns DFX, that holder gives up any claim on later deposits. Future additions to the recovery pool are then divided across the smaller remaining DFX supply.
The claim window remains open until Jan. 1, 2028. Any DFX that has not been claimed by that deadline will also be permanently burned.
Investor Takeaway
DFX is not equivalent to receiving one dollar back for every dollar lost. Its current value depends on the assets already inside the recovery pool, while holding the token preserves a claim on future deposits that an early redemption permanently forfeits.
Where Is the Rest of the Recovery Money Supposed to Come From?
The recovery model depends on several funding sources rather than a one-time reimbursement. Velocity will direct between 60% and 90% of daily net protocol revenue into the pool, depending on revenue levels. Recovered stolen assets will also be added.
The largest potential external contribution comes from Tether. FinanceFeeds previously reported that Tether committed up to $127.5 million to Drift’s recovery and relaunch plan, including a revenue-linked credit facility and support intended for the rebuilt platform. Strategic partners have separately committed up to $20 million.
Those headline commitments should not be confused with cash already available for redemptions. At launch, the recovery pool contained only about 3.1 million USDT, meaning the pace at which external funding, protocol revenue and recovered assets actually enter the pool will determine how quickly the redemption value rises.
The structure makes Velocity’s operating performance directly relevant to victims. Higher trading revenue should accelerate contributions, while weak activity would leave the recovery process more dependent on partner capital and successful asset recovery.
Investor Takeaway
The most important metric is not the nominal size of the promised recovery package but actual USDT entering the pool. Users should watch the pool balance, daily Velocity contributions and deployment of partner funding rather than treating the $147.5 million of potential outside support as already available.
Could the Frozen $9.2 Million Materially Improve Recoveries?
Drift Foundation said on Sept. 30 that approximately $9.2 million of stolen assets had been frozen, although returning those funds requires further legal and law-enforcement procedures. If recovered, the assets are expected to flow into the DFX pool.
The foundation said the attacker moved the stolen assets to Ethereum, distributing roughly 130,259 ETH across four wallets. Three wallets holding about 107,165 ETH had remained unmoved, while a fourth transferred approximately 23,094 ETH through Tornado Cash in July.
Mandiant identified the attacker as UNC6862, which Drift described as a North Korean threat group. The incident sits within a wider pattern of attacks attributed to North Korea-linked operators. FinanceFeeds has documented how crypto firms faced follow-on targeting after the Drift exploit, while its review of the largest crypto exploits of the first half of 2026 found North Korea-linked activity responsible for a substantial share of stolen value.
The unmoved ETH represents potential recovery value, but wallet inactivity does not mean the assets are controlled by Drift or available to victims. Freezing and ultimately returning crypto can require cooperation from stablecoin issuers, exchanges, investigators and law enforcement across multiple jurisdictions.
Investor Takeaway
The frozen $9.2 million would meaningfully increase a pool that started at roughly $3.1 million, but frozen assets are not yet recovered assets. The trajectory for DFX holders now depends on three measurable variables: actual asset recoveries, partner funding reaching the pool and Velocity generating enough revenue to make recurring contributions.