TL;DR
Drift is now Velocity, and the rename is structural rather than cosmetic: docs.drift.trade issues a 307 to docs.velocity.exchange, and the GitHub repo drift-labs/protocol-v2 returns a 301 to velocity-exchange/protocol-v2. The April 1, 2026 exploit was also bigger than our own risk table recorded. DeFiLlama's hacks list carries $295M, not $285.0M, classified as compromised admin plus fake token price manipulation, with no returned funds recorded. TVL is consistent with that: $550.13M on April 1 became $252.00M on April 2, a one-day fall of $298.13M. Four and a half months later nobody has been paid. Recovery tokens named DFX exist at one token per dollar of verified loss, but redemption does not unlock until the recovery pool reaches $5M, and the pool sits at $3.8M. Three things genuinely improved, and I checked all three rather than taking the team's word: the core program's upgrade authority is now a Squads V4 4-of-7 multisig with a one hour timelock and no config authority, up from the 2-of-5 with no timelock that was breached; the audits our facts said did not exist are real and downloadable; and the insurance fund is now 100% staker-owned with the protocol-owned shares removed. None of it changes the verdict.
Checklist
Audits and contracts. The repo's AUDIT.md names exactly two, Neodyme and Trail of Bits on protocol-v2, and both PDFs resolve live in the audits repo. That settles the open "zero audits" question in our facts: they exist. What they do not cover is what is running now. Velocity's own docs state both audits were on the pre-fork Drift v2 codebase, not on its deployment or new features, and that a post-fork OtterSec audit is being conducted and will be published on that page once finalised. It has not been. The audits repo has had no new file since January 2025, and the bug-bounty README in the protocol repo still reads "Bug Bounty for v2 (coming soon)". Press reporting adds that mainnet deployment is meant to require instruction-level audits, time-locked admin actions and review under Solana's STRIDE program, none of which is evidenced yet.
Admin control. Read directly from chain, not from a blog post. The core program dRiftyHA39MWEi3m9aunc5MzRF1JYuBsbn6VPcn33UH is upgradeable, and its authority 8jj7zJgdr5bDndc7evM74FMGwzLPmd4u4QxNzFi1BMai is off the ed25519 curve, so no single private key can sign for it. It derives exactly as Squads V4 vault 0 of multisig 7qipzLR9j1JcvdxE1XJEFgvoyFmgBpgw5hMdHBMPcJtM, which is threshold 4 of 7 members, timelock 3600 seconds, config authority none. The last upgrade, on 2026-06-29, was executed through the Squads program via a BatchExecuteTransaction, which I confirmed in the transaction itself. That is a real repair. Three caveats keep it off green. Nothing is immutable. One hour of timelock is notice, not an exit window. And the separate vaults program vAuLTsyrvSfZRuRB3XgvkPwNGgYSs9YRYymVebLKoxR sits behind a 3-of-5 with zero timelock whose config authority is set rather than none, which in Squads V4 means config changes bypass member voting.
Oracle. Verified this run rather than carried forward. Pyth is the default variant of the OracleSource enum in the program source, alongside Switchboard and the Pyth pull and Lazer variants. The guard rails re-read on the moved docs domain are a seven-state validity spectrum, TWAP sanitization requiring new values within 10%, 20% or 50% of the prior TWAP depending on ContractTier, and a price band requiring the 5-minute oracle TWAP to sit within roughly 10% of the AMM reserve price for fills, PnL settlement and deficit resolution. Worth remembering how those guard rails were beaten in April: they were not. The attacker used stolen admin rights to whitelist a token with no Pyth feed and point it at an oracle they controlled.
Liquidity and exit. The worst line on the card. Anyone caught in the drain holds a transferable DFX claim they cannot redeem, because redemption is gated on a pool crossing $5M that has not crossed it, and the pool holds $3.8M. Anyone who does redeem early takes a pro-rata share of whatever is in the pool at that moment and forfeits the remainder of their claim. Tether pledged up to $127.5M tied to performance and partners another $20M, but pledges are not payments. Live TVL of $214.32M is 14.2% of the $1.50B October 2025 peak and down 20.7% over 90 days.
Yield: real vs emission. Perp and borrow fees plus insurance-fund staking are real revenue, not emissions, which is the honest half. The fund's economics also improved: it is documented as 100% staker-owned, the protocol-owned insurance-fund shares that existed under Drift were removed, there is no admin withdrawal path, and the only protocol-side balance is non-withdrawable seed ballast. The other half is that the venue is in private beta mid-relaunch, so any APR quoted today describes a system that is not fully running, and insurance-fund staking is risk underwriting rather than passive yield, with losses beyond a market's cap socialized across depositors and traders.
Holder concentration. Partly measured. DRIFT's mint authority and freeze authority are both revoked and supply is fixed near 999,998,408 tokens, so no one can inflate or freeze it. The actual distribution would not pull this run because the public RPC rate-limited the largest-accounts call, and the DFX recovery token is a second claim on the same estate that nobody has sized. refresh
Track record. Two incidents on DeFiLlama, not one, which corrects our previous report. April 1, 2026, $295M, admin compromise, no returned funds recorded. And May 11, 2022, $14.5M from a realized-PnL withdrawal bug, which was fully repaid. The 2022 event is old and was made good; the 2026 one is recent, central, and open.
Worst case
The headline worst case already happened, and the forward one is that it stays unresolved. Roughly $295M left the protocol in minutes; the recovery pool meant to repay it holds $3.8M and depends on future revenue from a venue that has not fully relaunched. If the Tether and partner money arrives slowly or partially, DFX holders are left marking a claim at a deep discount to par for years, and the early-redemption term converts impatience into a permanent haircut. The second scenario is a repeat on fresh code. The relaunched program carries no published audit, the bug bounty is not live, and the attacker class here was state-sponsored social engineering aimed at people and signing process, which a code review does not fix. The third is narrower and specific: the vaults multisig has zero timelock and a config authority that is set rather than none. I could not identify what controls that address. It is off-curve, holds no data, is owned by the system program, is not a Squads vault of either known multisig at indices 0 through 7, and its only on-chain history is inbound compressed-NFT transfers that look like spam. Read one way, some unidentified program can rewrite that multisig's members and threshold without a vote. Read the other way, nothing can sign for it and the vaults config is frozen. Neither reading is comfortable, and I could not settle it.
Bottom line
Avoid, and not by a narrow margin. Two dimensions are red on the surface where money is actually lost. Users from April are still not whole, still cannot redeem, and the venue they were harmed on has been renamed and redeployed without a public audit of the new code. The honest update is that this is a better-run protocol than it was in July: the admin model was genuinely rebuilt, the insurance fund now belongs entirely to its stakers, and I can point at a 4-of-7 with a timelock on chain rather than a promise. That earns a note, not a rating change. The conditions for re-rating are concrete and none of them are met. Publish the OtterSec post-fork audit. Open the bug bounty. Show the recovery pool crossing $5M and paying a first tranche. Close or explain the vaults config-authority hole. Lengthen that one hour timelock to something a depositor can act inside. Then it is worth looking at again.
Data appendix
- TVL: $214.32M (DeFiLlama "drift", 2026-08-11, orchestrator-verified). An independent re-read of the same series this run returned $213.59M for the 2026-08-11 daily point and $211.28M at the latest intraday stamp, so the figure moves inside a band of roughly 1.5% during the day. The prior report carried $217.5M, so it is flat. 90d: $270.28M on 2026-05-13, so down 20.7%. ATH $1,504.36M on 2025-10-09, so current is 14.2% of peak. Hack window: $534.58M on 2026-03-31, $550.13M on 2026-04-01, $252.00M on 2026-04-02, a one-day drop of $298.13M. That drop corroborates the $295M figure but is not a clean measure of it, since TVL also moves on price and withdrawals. Live open interest and perp volume: refresh.
- Incidents (DeFiLlama /hacks, 621 records scanned): 2026-04-01, Drift Trade, $295,000,000, Solana, classification Infrastructure, technique "Compromised Admin + Fake Token Price Manipulation", returnedFunds null (none recorded). Also 2022-05-11, $14,500,000, classification Protocol Logic, technique "realized PnL withdrawal bug", returnedFunds $14,500,000 (fully repaid). Note: our internal risk table records $285.0M for the 2026 event, which is below both the DeFiLlama figure and the observed TVL drop. Press figures range from "over $280M" through $285M to $295M.
- Audits: Two on protocol-v2, verified as files. velocity-exchange/protocol-v2 AUDIT.md lists exactly Neodyme and Trail of Bits; both PDFs resolve in velocity-exchange/audits under protocol-v2 (neodyme.pdf 1,262,206 bytes, tob.pdf 1,694,477 bytes). The audits repo also carries a third file, drift-vaults/neodyme.pdf (358,713 bytes), covering the vaults program. Note the repo drift-labs/audits now 301-redirects to velocity-exchange/audits, and its last push was 2025-01-28, so nothing has been added post-hack. Per the docs audits page: Trail of Bits Nov 7 to Dec 2 2022 with a Jan 23 to 25 2023 follow-up, quote, "The audit did not uncover any high-severity flaws that could impact system confidentiality, integrity, or availability"; Neodyme authored 2024-05-10, updated 2024-06-27, scope protocol-v2. The same page states, quote, "The audits below were performed on the pre-fork Drift Protocol v2 codebase that Velocity forked from, not on Velocity's own program deployment or its new/changed functionality", and that a post-fork OtterSec audit is in progress and will be published there once finalised. Bug bounty: velocity-exchange/protocol-v2/bug-bounty/README.md reads "# Bug Bounty for v2 (coming soon)"; the docs audits page carries no bug-bounty statement. This corrects our facts row showing zero audits.
- Admin/governance (read from Solana mainnet this run): Core program dRiftyHA39MWEi3m9aunc5MzRF1JYuBsbn6VPcn33UH, owner BPFLoaderUpgradeable, executable, so upgradeable and not immutable. ProgramData 7dLgmtcTavcguNoynVimF9ZNVb13FvhXVRfj2HyrDGaP, upgrade authority present (not None) at 8jj7zJgdr5bDndc7evM74FMGwzLPmd4u4QxNzFi1BMai. That authority is off-curve and derives as Squads V4 vault index 0, bump 254, of multisig 7qipzLR9j1JcvdxE1XJEFgvoyFmgBpgw5hMdHBMPcJtM: threshold 4, members 7 (six with Initiate+Vote+Execute, one, prpHJmuXnqdaz92tBVdwsqmqyhqPLuq5Km35a5QWco3, with Initiate only), time_lock 3600s, config_authority all-zero meaning none/autonomous, transaction_index 88. Last deploy slot 429731225 = 2026-06-29 19:57 UTC, and the transaction at that slot invoked SQDS4ep65T869zMMBKyuUq6aD6EgTu8psMjkvj52pCf with instruction BatchExecuteTransaction, confirming the Squads path. Vaults program vAuLTsyrvSfZRuRB3XgvkPwNGgYSs9YRYymVebLKoxR is likewise upgradeable; ProgramData 2cnQci7cy1fm95o7Mv8d4MpY1KCCgF7zPQG1znWqZkKC, authority Ad21qwCb3C98M6UNqjGsZgR48549Spp7W1UWETV29cZ9, which is Squads V4 vault 0, bump 255, of multisig BBC5gSPh71YB2eUXdCqvkmL6kj6YDkUQJpX997qXUt2Q: threshold 3, members 5 (all five with full permissions), time_lock 0, config_authority A1eC8n2tQBHPodn8sZHsc5XWciunZy9B1VgmcHgK1xhP, rent_collector 39JyWrdbVdRqjzw9yyEjxNtTbTKcTPLdtdCgbz7C7Aq8 which is also member index 1. Vaults last deploy slot 410041556 = 2026-03-31 07:12 UTC, one day before the hack, not redeployed since. On the vaults config authority: it is off-curve, owned by the system program with zero data length and 890,880 lamports, is not a Squads vault PDA of either known multisig at indices 0 through 7, and its three most recent transactions (latest 2026-04-18) are Metaplex Bubblegum compressed-NFT transfers signed by an unrelated key. Its controller is therefore unidentified, and whether anything can sign for it at all is unresolved. Neither program is immutable. The ed25519 curve test used here was validated against controls first: 198 of 400 random 32-byte values on-curve, the all-zero address correctly rejected, and a freshly derived PDA correctly off-curve.
- Oracle: Pyth, verified two ways this run. In source, programs/drift/src/state/oracle.rs declares OracleSource with Pyth as the #[default] variant, plus Switchboard, SwitchboardOnDemand, the Pyth pull variants and the PythLazer variants. In docs at protocol/risk-and-safety/protocol-guard-rails: a seven-state validity spectrum (NonPositive, TooVolatile, TooUncertain, StaleForMargin, InsufficientDataPoints, StaleForAMM, Valid), TWAP sanitization requiring new values within 10%, 20% or 50% of the previous TWAP by ContractTier, the on-chain TWAP shrunk proportionally to the duration of an invalid period, and a perp price band requiring the 5-minute oracle TWAP to be within roughly 10% of the AMM reserve price for fills, PnL settlement and deficit resolution. In the April exploit the attacker whitelisted CVT, which has no Pyth feed, against an oracle address they set, using stolen admin rights.
- Insurance fund (verified at docs.velocity.exchange/protocol/insurance-fund; our earlier 404 was a wrong path, not a missing page): per spot/collateral market, funded by a capped share of trading, liquidation and borrow fees settled from the revenue pool plus a lending-yield carveout via insuranceFund.ifFeeFactor. It is documented as 100% staker-owned, with the protocol-owned insurance-fund shares from the Drift era removed and no protocol split on settled revenue; pre-launch seed shares are described as permanent, non-withdrawable ballast rather than a live protocol claim, and no admin withdrawal mechanism is documented. Perp markets draw on their quote asset's fund, capped by contract tier, with the riskiest tiers receiving no backstop. Losses beyond the cap are socialized pro-rata across depositors and positions.
- Liquid staking (dSOL): the mint Dso1bDeDjCQxTrWHqUUi63oBvV7Mdm6WaobLbQ7gnPQ does resolve on chain, correcting an earlier failed lookup. SPL Token program, supply 2,322,926.32 dSOL, freeze authority none, mint authority 6727ZvQ2YEz8jky1Z9fqDFG5mYuAvC9G34o2MxwzmrUK. That authority is an address holding no data and no owner record, consistent with a stake-pool withdraw-authority PDA but not confirmed as such this run. refresh on which program controls it.
- Recovery status: recovery tokens are branded DFX, issued at one token per $1 of verified loss and transferable. Redemption is gated on the pool reaching $5M; the pool holds $3.8M of remaining protocol assets, and early redeemers take a pro-rata share and forfeit the rest. Tether up to $127.5M tied to performance plus partners up to $20M, so up to $147.5M against roughly $295M of claims. A Recovery Token and Insurance Fund claim checker is live; insurance-fund claims are described as opening in the coming weeks and DFX claims when the exchange relaunches, so no payout has occurred. Attribution to a DPRK-linked group (Lazarus, reported as UNC6862 by Mandiant) is consistent across coverage.
- Rebrand: docs.drift.trade returns 307 to docs.velocity.exchange (and /security/audits 307s on to /protocol/risk-and-safety/audits); api.github.com/repos/drift-labs/protocol-v2 returns 301 to velocity-exchange/protocol-v2 (407 stars, 241 forks, last push 2026-07-08, not archived, Apache-2.0). Announced around 2026-07-01. Per The Defiant and Cryptopolitan: perps-only, settled in USDT rather than USDC, Isolated Markets and Amplify dropped, the durable-nonce mechanism the attackers abused removed, freshly deployed program with rotated keys, private beta to selected partners and traders, no public relaunch date. The new post-fork program address was not located this run, so the on-chain reads above describe the existing Drift v2 and vaults programs; whether DeFiLlama's adapter tracks those same programs was not confirmed. refresh.
- Token: DRIFT at solana:DriFtupJYLTosbwoN8koMbEYSx54aFAVLddWsbksjwg7, SPL Token, supply 999,998,407.76 with 6 decimals, mint authority none and freeze authority none, both verified on chain. Holder distribution: refresh, the public RPC returned 429 on the largest-accounts call. DFX distribution also unmeasured.
- Recent-news scan: dominated by the rebrand to Velocity and the unfinished recovery. No evidence of a second incident since April 1, 2026. Maintained monthly. Methodology: DeFi Research Instruction v2.