Drift Protocol

Summary

Drift Protocol was founded in 2021 by Cindy Leow and David Lu (with additional co-founders including engineer Chris Heaney) and launched on Solana mainnet in late 2021 after a $3.8M seed round led by Multicoin Capital. It became Solana's largest perpetual-futures DEX, notable for iterating through three distinct liquidity architectures: a virtual "dynamic AMM" (v1), a hybrid JIT-auction/orderbook/AMM stack (v2, December 2022), and a performance-focused v3 (December 2025). Drift survived a May 2022 bank run triggered by the Terra/LUNA collapse — repaying users in full — issued the DRIFT token via a May 2024 airdrop, raised a $25M Series B in September 2024, and crossed $1B TVL in January 2025 with over $133B cumulative volume. On April 1, 2026, attackers linked by investigators to North Korea's Lazarus Group gained administrative control through months of social engineering and drained roughly $285–295M (over half of TVL). The team halted the protocol, published a recovery-token restitution plan backed partly by a Tether credit line, and rebranded to Velocity DEX on July 1, 2026, entering private beta ahead of a planned Q3 2026 relaunch.

Design (Mechanism)

v1 — Dynamic AMM (DAMM). Drift v1 generalized Perpetual Protocol's virtual AMM: instead of a static constant-product curve, the DAMM anchored its price around an oracle-derived midpoint and could "repeg" and adjust virtual liquidity depth dynamically. Traders posted cross-margined collateral against the vAMM; funding payments trued perp prices to the oracle. No external LPs were needed to bootstrap markets.

v2 — Three-tier hybrid liquidity. After v1's failure modes were exposed, v2 (December 2022) rebuilt the exchange around three liquidity sources with explicit routing priority: (1) Just-in-Time (JIT) auctions — every taker order enters a ~5-second Dutch auction in which market makers can fill at or better than a price that decays from the best (DAMM bid) toward the DAMM ask; (2) a decentralized limit orderbook (DLOB) maintained off-chain by an incentivized keeper network that matches and settles orders on-chain; and (3) the DAMM itself as backstop liquidity if no maker fills. v2 also added spot markets with borrow/lend, unified cross-margin across all assets, a revamped risk engine with a tiered liquidation mechanism, and a stakeable insurance fund that earns fees in exchange for absorbing shortfalls. The mainnet program (dRiftyHA39MWEi3m9aunc5MzRF1JYuBsbn6VPcn33UH) was audited by Trail of Bits, OtterSec, and Neodyme.

Token and growth mechanics. DRIFT launched May 16, 2024, with a 120M-token airdrop (~12% of supply) to ~150,000 wallets, including a novel "wait to double your claim" decay mechanic; the FUEL points program drove a second season (May 2025). v3 (December 4, 2025) targeted CEX-parity execution: ~10x faster fills, deeper liquidity, gasless trading by default.

Outcome

Drift became the dominant Solana perps venue: >$1B TVL by January 2025 (peak ~$1.5B), $133B+ lifetime volume, and a broadening product suite (spot, lending, vaults, prediction markets — including the BET platform). Two crises bracket the story. In May 2022, the LUNA collapse triggered a levered "run on the bank": a PnL/collateral mischaracterization bug let traders withdraw unrealized profits without adequate checks, draining ~$8.7M in 12 hours and leaving a ~$14.5M shortfall; Drift halted v1, raised ~$15M in emergency financing, and repaid all users ($19.5M total settled). In April 2026, attackers posing as a quantitative trading firm spent months building trust, then abused Solana's durable-nonce feature to get Security Council members to unknowingly pre-sign admin-transfer transactions. With two transactions executed one second apart they seized full admin control, minted a fake "CVT" token as collateral, and drained ~$285–295M across at least 18 token types (including $71.4M USDC and $159.3M JLP) in roughly 31 transactions. ZachXBT, Elliptic, and TRM Labs attributed the attack to Lazarus Group; funds were bridged to Ethereum and, on July 24, 2026, 23,095 ETH was laundered through Tornado Cash. The recovery plan issues $1-pegged recovery tokens against $295.4M of verified losses, funded by protocol revenue and up to ~$127.5M in Tether credit (conditioned on switching settlement from USDC to USDT). The protocol rebranded to Velocity DEX on July 1, 2026.

Why it worked

• Oracle-anchored liquidity solved cold-start: the DAMM let Drift list markets with zero external LPs, and v2's JIT auctions imported professional market-maker competition on top, giving takers price improvement without resting-liquidity requirements.
• Honest crisis handling built durable trust: fully repaying users after the 2022 insolvency (rather than socializing losses and walking away) is why users returned for v2 and why TVL could reach $1B+.
• Solana's throughput made a hybrid on-chain orderbook viable, letting Drift converge toward CEX-grade UX (sub-second fills, gasless trading) that EVM L1 perps could not match.
• Aggressive distribution mechanics (airdrop with time-decay doubling, FUEL points) converted mercenary volume into a large verified user base.

Where the design broke

• v1's risk engine conflated unrealized PnL with withdrawable collateral and lacked socialized-loss/clawback machinery, so a volatility spike became a bank run.
• The 2026 catastrophe was governance/opsec, not code: years of program audits were bypassed because admin authority ultimately rested with humans who could be socially engineered; durable nonces let pre-signed transactions lie dormant until sprung.
• Admin powers were catastrophic in scope — the ability to list a token, set its price/collateral status, and drain vaults meant one compromised council was equivalent to full protocol ownership.
• Restitution is slow and contingent: without partner funding, full repayment was projected to take up to ~8 years, and the Tether deal traded restitution speed for stablecoin lock-in.

Lessons

• Withdrawal paths are the risk surface. Unrealized PnL must never be treated as free collateral; any perp venue needs settlement gating, insurance waterfalls, and explicit socialized-loss rules before the first crisis.
• Audit the admin, not just the program. Verified code is irrelevant if a security council can be phished; privileged operations need timelocks, transaction simulation/decoding at signing time, and hardware flows that make durable-nonce pre-signing visible.
• Liquidity mechanisms can be layered, not chosen. Drift's JIT-auction → orderbook → AMM-backstop routing showed that vAMMs work best as a backstop of last resort, with competitive maker flow handling the margin.
• Making users whole is a franchise asset — Drift's 2022 full repayment bought it four more years of growth; the 2026 recovery-token plan attempts the same playbook at 20x the size, with far less certain odds.
• Nation-state adversaries price in your entire org chart: months-long relationship-building attacks mean counterparty diligence and insider-threat controls are now table stakes for any protocol holding nine figures.

Redesign (EDITORIAL — hypothesis, not fact)

This is editorial speculation. The mechanism stack (JIT + DLOB + DAMM backstop) is arguably best-in-class and needs no redesign; the failure was authority architecture. A redesigned Drift would make admin power structurally incapable of draining vaults: new-market listing and collateral-weight changes behind a mandatory 48–72h on-chain timelock with public diffing; oracle/price-setting for any collateral asset restricted to established oracle networks (never admin-settable); withdrawal rate-limits per vault (e.g., no more than X% of TVL per hour without a timelocked override) so a compromise bleeds slowly enough for keepers to freeze it; and council signing done only through devices that render full transaction semantics, with durable-nonce transactions rejected by policy. On the restitution side, recovery tokens should be tradeable from day one with a protocol-revenue buyback auction, letting victims who need liquidity exit at market while long-horizon holders capture the recovery upside — turning an eight-year IOU into a priced instrument.