Drift Review (2026): The $285M Hack, the Velocity Relaunch and Is It Safe Now?

Drift is no longer a safe default for Solana perps: it lost about $285 million in an April 1, 2026 admin-key takeover and relaunched at the end of September as Velocity, a USDT-margined perps exchange with five markets and very little volume. It scores 5.3/10 in our method, the lowest of the Solana perps DEXs we rank: well documented, but held back by the hack, thin liquidity and a slow recovery for victims.

Risk notice: Crypto trading is high risk and leverage can liquidate your whole position in minutes. Perps DEXs and wallet connections use hot wallets. This page is not financial advice; only trade what you can afford to lose.

Facts on this page were checked October 23, 2026, from Velocity's and Drift's own docs and the sources linked below. This is a research-based review built from published docs, not a hands-on trial.

Drift's 2026 status at a glance

• Then: Drift Protocol was one of Solana's best-known perps and lending exchanges, launched in 2021 (Crypto Winrate).
• April 1, 2026: drained of about $285 million (Chainalysis).
• April 16: Tether and partners proposed up to $147.5 million in support, and Drift said it would switch from USDC to USDT (CoinDesk).
• June 3: Drift named Noah Prince, formerly of Helium, as Head of Protocol and said Mandiant attributed the attack to North Korean group UNC6862 (Drift update).
• Late September: the exchange restarted as Velocity after audits by OtterSec and Asymmetric Research, and co-founder Cindy Leow said she was stepping down (ChainCatcher, September 30, 2026).
• October 2026: the DFX recovery program is live, but the pool reportedly covers only about 1% of claims (KuCoin News / TechFlow).

The official site is now velocity.exchange, and the old Drift domain points recovery users to dfx.drift.trade.

What happened in the April 2026 hack

This was not a bug in the trading engine. According to Chainalysis, the attacker spent weeks preparing:

1. Fake collateral. From March 12 the attacker created a token called CVT, held about 80% of its supply and wash-traded it near $1 in a tiny pool.
2. Pre-signed admin transactions. Using Solana's durable nonces, the attacker got Security Council members to sign transactions they did not fully understand, which could be executed later.
3. Weaker controls. On March 26 Drift moved to a new 2-of-5 multisig with a zero timelock, so admin actions took effect immediately.
4. The takeover. On April 1 at about 16:05 UTC two pre-signed transactions ran one second apart and handed admin control to the attacker. CVT was then whitelisted as collateral, 500 million CVT was deposited, and real assets were withdrawn.

The damage spread: Bitcoin.com News reported effects on more than 20 protocols built on Drift's vaults. The lesson for any perps DEX: check who holds admin keys, how many signatures they need and whether changes are timelocked.

What Velocity is now

Velocity is a fork of Drift v2 with a narrower focus. Per its homepage and market stats:

• Markets: BTC, ETH and SOL at up to 20x, HYPE and ZEC at 10x. Stock markets are listed as coming soon.
• Collateral: USDT is the quote asset; other assets such as SOL count at lower weights. Velocity's margin docs use SOL at 80% initial and 90% maintenance weight as an example. Everything in a subaccount backs every position (cross-margin).
• Lending: deposits can earn interest, and the same vault holds perp collateral and lent balances.
• Liquidity: fills come from Just-in-Time auctions, a keeper-run order book and a virtual AMM backstop, according to an independent review.
• Custody: non-custodial; you trade from your own Solana wallet.

Fees

From Velocity's fee docs, by trailing 30-day volume:

Those are baseline rates for SOL, BTC and ETH perps. The docs say rates are admin-settable, so check the live value. Referred users get 5% off while builder codes are enabled. A $10,000 market order at the Regular tier costs $6 to open and $6 to close (our arithmetic), the same as Jupiter's base fee and above Pacifica's 0.040%.

Liquidations and leverage

Velocity's liquidation docs are among the clearest on Solana. Your account is liquidatable when collateral falls below maintenance margin. Open orders are cancelled first, then only enough of the position is closed to restore a 2% buffer.

Their worked example: $10,000 of collateral backing a 1,000 SOL long at $100 ($100,000, so 10x) with 3% maintenance margin. A 7.22% drop to $92.78 triggers liquidation, 57% of the position is closed, and the liquidator and insurance fund each take $398. That is the core risk of leverage: a 7.22% price move had already wiped out about 72% of the account's $10,000 equity before any fee (our arithmetic). At 20x the move needed is roughly half that.

Is Velocity safe now?

What has improved, per Velocity's docs:

• Audits: OtterSec audited the post-fork code from June 19 to July 20, 2026, with a final report on September 3: 0 Critical, 41 High and 109 Medium findings, all Highs fixed in deployed code (audits).
• Tiered admin keys: routine "warm" changes go through a timelock, and the pause key can only add pauses (admin keys).

What still worries us:

• Root changes aren't timelocked. The same page says "cold" root-authority changes, such as replacing a market's oracle, are not timelocked, and it doesn't publish key custody or multisig thresholds. Oracle and admin control were exactly what the attacker abused.
• Open-source status is unclear. The admin-keys page says the program is not yet open source, while ChainCatcher reported the code was fully open-sourced at relaunch.
• Thin liquidity. DefiLlama shows about $2.21M of 30-day volume and $95,213 of open interest (DefiLlama). Thin books mean wider spreads and messier liquidations.

The DFX recovery program

Victims got 1 DFX per 1 USDT lost. DFX is not pegged to 1 USDT, is paid from a pool funded by exchange revenue and Tether's revenue-matched commitment, has a claims deadline of January 1, 2028, and can be traded on Raydium (KuCoin News). Only use the official link the Drift Foundation names, dfx.drift.trade. Fake "Drift refund" or "DFX claim" sites are a predictable scam; never connect a wallet to one from a DM or ad.

Drift vs the alternatives

Sources: DefiLlama, checked October 23, 2026. For most traders Jupiter Perps is the simpler, deeper option; see Drift vs Jupiter Perps. If you want perps inside a memecoin terminal, Axiom offers Hyperliquid perps instead of a Solana venue.

Verdict

Velocity has good docs, a fresh audit and a maker rebate, and it is the only way former Drift users can help fund their own recovery. But it is a brand-new deployment from the team behind 2026's biggest DeFi hack, with five markets and almost no volume. If you trade there, keep size small, use low leverage and withdraw what you aren't using. Visit Velocity

Perps gains and losses are taxable in most countries; see Solana memecoin taxes. For transaction tips that help orders land during volatility, read Solana priority fees and slippage.