Drift Protocol has outlined how it plans to compensate users after the hack: relaunch the platform, generate trading revenue, and route that income into a dedicated recovery pool. According to the update tied to June 2026, the pool is intended to repay users affected by the attack. As of June 4, 2026, no recovery payouts had been processed, and the protocol said more detail on timing and mechanics would come later.
Mandiant linked the attack to UNC6862
The relaunch plan is built on a public attribution process, not just an internal incident report. Cybersecurity firm Mandiant carried out an independent investigation and attributed the attack to UNC6862, described in the source material as a North Korean state-sponsored threat group. The finding was based on matching tactics, tools, and operational fingerprints seen in other crypto attacks.
That attribution matters because Drift is framing the incident as part of a broader pattern of state-linked theft targeting crypto platforms. The protocol's response has been unusually public, with the forensic conclusion placed at the center of its recovery update.
Revenue from the reboot is meant to fund repayments
Drift's proposed recovery structure is simple on paper. The platform restarts, trading resumes, revenue is generated, and that revenue flows into the recovery pool for users who still have outstanding losses. The source makes a point of saying the plan does not rely on a future token or vague compensation language. It is tied to operating performance.
For affected users, that creates a direct link between repayment speed and post-relaunch activity. If the venue performs well, the pool fills faster. If trading is slow, recovery would likely take longer. The material provided does not specify payout order, distribution ratios, or exact eligibility criteria, only that the pool is designed to address unresolved user losses.
Tether backs the relaunch around USDT-margined perpetuals
Tether is providing strategic support for the comeback. With that backing, Drift plans to relaunch as a USDT-margined perpetual exchange on Solana, where trades and positions are settled in USDT. The stated ambition is clear: become the largest USDT perps exchange in the Solana ecosystem.
That business model sits at the center of the recovery effort. A perpetual futures venue earns from trading activity, so the strength of the relaunch is not just a market-share question. It also affects how quickly the recovery pool can accumulate funds for users.
New protocol leadership and Gauntlet-linked risk talent join rebuild
Drift is also changing who rebuilds the system. Noah Prince is joining as Head of Protocol after previously serving as Head of Protocol Engineering at Helium, where he led Helium's migration to Solana. At Drift, his mandate is to strengthen the codebase and harden the platform's security architecture.
Former members of the Gauntlet team are also being brought in. Their work will cover the liquidation engine, funding rates, market parameters, liquidator optimization, and ongoing risk monitoring. Those are core pieces of a perpetual trading venue, and Drift said the codebase would be overhauled before anything goes live again.
The missing details are timing and payout mechanics
The broad structure is now public: forensic attribution from Mandiant, strategic support from Tether, new engineering leadership, and a recovery pool funded by platform revenue. What remains unresolved is the part most users care about most — when repayments start, how they are calculated, and how long the pool may take to build after relaunch. Drift said those details would be shared in later updates.