Drift says insurance fund untouched after attack, withdrawals to resume

Drift Protocol said its insurance fund was not affected by the recent attack and that users who staked into the fund will be able to withdraw their shares normally once the protocol is brought back online.

Drift said in an official post on X that users who staked into the Insurance Fund will be able to withdraw their corresponding shares once the protocol is restored. The protocol added that the fund itself was not affected by the attack because Drift was paused before any losses could be completed through “normal liquidation or bankruptcy processes.”

That distinction matters because Drift’s own documentation defines the Insurance Fund as the first backstop for maintaining exchange solvency in the event of bankruptcies. More detailed staking documentation says users can unstake from the fund, although withdrawals are subject to a cooldown period of 13 days.

The update follows one of the biggest Solana DeFi breaches of the year. In April, crypto.news reported that the Drift hack drained about $285 million through a compromised administrator key in what security researchers described as a social engineering attack rather than a smart contract flaw.

Why the fund was spared

Drift’s explanation is straightforward: the insurance mechanism exists to absorb insolvency created by liquidations and bankruptcies, not to retroactively cover an external exploit that was halted before those internal loss pathways finished playing out. In its latest statement, the team said that because the protocol was paused early enough, the Insurance Fund never became part of the loss cascade tied to the vulnerability.

That aligns with outside reporting on the incident. Elliptic estimated the exploit at $286 million and said Drift suspended deposits and withdrawals during the attack, while Chainalysis described the breach as a privileged-access compromise that led to roughly $285 million in losses over a matter of minutes.

The protocol had already signaled that the fund was being secured as a precaution. Reporting from Binance cited Drift as saying the insurance fund assets were unaffected and were being withdrawn to enhance protection after the exploit.

Recovery and restart plan

Drift now says assets from the protocol’s own Insurance Fund will be used to support the system restart and broader user recovery, and that it plans to publish the relevant on-chain addresses so the community can track how the funds are used. That is a notable shift from simply ring-fencing the fund toward actively deploying part of it in the recovery process.

The insurance fund is only one part of Drift’s broader rebuilding effort. In April, multiple outlets reported that the protocol had lined up as much as $147.5 million in support for affected users, including up to $127.5 million from Tether and another $20 million from partners, while later recovery plans pointed to recovery tokens tied to verified losses, as covered by CoinMarketCap and RootData.

For users, the immediate takeaway is narrower and more important: insurance fund stakes were not wiped out in the exploit, and normal withdrawals are expected to resume after Drift’s recovery process is complete.