Drift Protocol Rebrands to Velocity After $285M Hack

Steady attention without excessive speculation.

Velocity said the rebrand marks a line between what was and what comes next. The team also promised a private beta for select partners and traders in the coming days.

Inside the Drift Protocol Rebrand

The announcement framed Velocity as a reset. According to the team, the new platform offers a cleaner architecture and a stronger security foundation.

The old name carried heavy baggage. So the Drift Protocol rebrand tries to separate the future product from the April breach.

Velocity has not shared deep technical details yet. Still, the messaging leans hard on trust repair and security.

The code base moved too. The protocol-v2 repository shows recent renames from drift-labs to velocity-exchange.

How the $285 Million Hack Happened

The April 1 attack did not exploit a bug in Drift’s core code. Instead, it targeted the people who held admin keys.

The operation started in fall 2025. Attackers posed as a quantitative trading firm and built relationships at conferences.

Over several months, they gained trust and integrated with a vault. Then they compromised signer devices through a malicious repo or a fake TestFlight app.

The final step abused a Solana feature called durable nonces. These let attackers hold pre-signed multisig approvals that later transferred admin control.

The multisig setup made things worse. Reports say it used a 2-of-5 threshold with zero timelock at the time.

Once the attackers held admin rights, the drain moved fast. According to Chainalysis, they overrode limits and emptied vaults within minutes.

The loss topped 50% of protocol value at the time. Estimates range from about $270 million to $295 million, and most reports settle near $285 million.

Who Was Behind the Attack

Forensic firms point to North Korea. TRM Labs, Chainalysis, and Elliptic link the heist to state-affiliated actors with medium-to-high confidence.

Analysts tie the group to labels such as UNC4736, AppleJeus, and Golden Chollima. Some reports connect it to broader Lazarus Group operations.

The attribution stays a careful assessment, not a courtroom verdict. So the firms use words like likely and suspected.

The laundering followed a familiar pattern. Investigators say the funds moved from Solana to Ethereum through CCTP shortly after the drain.

On-chain sleuths flagged the attacker admin address early. Analysts also traced portions of the funds into wallets marked at exchanges.

The Tether-Led Recovery Plan

Users did not walk away empty-handed. On April 16, 2026, Tether and partners announced a recovery collaboration worth up to nearly $150 million.

The plan pairs the recovery with a shift to USDT settlement. According to the announcement, it uses grant and credit-facility elements.

Still, the structure is not a simple one-to-one refund. Some parts tie repayment to future revenue, so full recovery remains in progress.

The token market felt the damage too. The DRIFT governance token fell roughly 30% to 40% right after the exploit.

Protocol value also collapsed. TVL slid from about $550 million before the hack to roughly $208 million now, according to DefiLlama.

What a Stronger Security Foundation Could Mean

Velocity has stayed vague on specifics. Still, security experts expect a few obvious fixes after this kind of breach.

Stricter access controls top the list. A mandatory timelock on admin actions would slow any future takeover attempt.

Better signing tools also help. Clearer multisig interfaces make it harder to approve a malicious transaction by mistake.

Device hygiene matters just as much. Tighter compartmentalization for signer devices would limit the damage from a single compromise.

Fresh audits round out the checklist. The team may also move away from the durable-nonce behavior that enabled the attack.

Community Splits Over the Rebrand

Reaction on X split fast. Many retail users called the move an attempt to bury the hack behind a new logo.

One common jab summed up the mood. Critics argued that a rebrand only sticks if the security overhaul is real.

Others pushed back with cautious optimism. Some insiders and traders welcomed the rebuild and the focus on new security work.

Trust remains the core problem. Because past signer hygiene failed, many users now want proof, not promises.

What Comes Next for Velocity

The near-term test is the private beta. Velocity plans to open it to select partners and traders in the coming days.

Key questions stay open. Velocity has not disclosed audit results, new contract addresses, or the full details of its redesign.

The recovery story also continues. Traders will watch whether the Tether plan delivers real reimbursement over time.

For now, the Drift Protocol rebrand marks a high-stakes reset. Velocity has to prove that the new name rests on stronger foundations, not just fresh branding.

None of this is financial advice. Always do your own research before making any investment decision.