Tether throws $128m lifeline to hacked Drift. But the USDT issuer wants something in return

Stablecoin giant Tether has said it will help Drift Protocol with a recovery plan to return stolen money to users after the decentralised exchange was hacked earlier in April.

But the recovery plan has one condition: The deal, aimed at recovering the lost $286 million, means that Drift will use Tether’s USDT as its main stablecoin — and not arch-rival Circle's USDC.

“The recovery plan presents a clear, revenue-driven model that prioritises Drift users from day one,” Tether said in a statement.

“Additionally, as part of the relaunch, Drift will transition its settlement asset from USDC to USDT, bringing more than 128,000 users and over 35 ecosystem teams onto USDT-based trading.”

Hackers on April 1 drained over $286 million from the Solana-based trading platform. Investigators have since accused North Korean cybercriminals of being behind the heist.

Tether said Thursday that it would give Drift Protocol $127.5 million as part of the recovery plan. Other unnamed partners are proposed to contribute $20 million, the statement said.

Tether did not immediately respond to questions from DL News. Drift Protocol refused to comment further.

The recovery process

Drift Protocol said in a plan that it would use the cash to fund a recovery pool for user losses — now at $295 million.

The exchange said it was working with law enforcement and blockchain forensics to recover the money.

Drift added that a special token would be issued to those who lost money. Each token would represent a claim on the recovery pool and will be transferable, Drift said.

The protocol will relaunch after it has been audited by two different security firms, OtterSec and Asymmetric.

Hackers were able to hack the protocol after they spent months building relationships with the Drift team, blockchain researchers said. They met them in person at conferences and pretended to be from a legitimate trading organisation.

The cybercriminals then tricked multisig signers into signing transactions they did not fully understand, handing over admin control. The criminals were then able to change protocol permissions and withdraw funds.

As part of the relaunch, Drift said that multisig signers would operate on dedicated signing devices and identities of signers would be “maintained on a need-to-know basis.”

DeFi woes 

Drift’s hack came as the decentralised finance space faces increased scrutiny over its security.

Before hackers targeted Drift, cybercriminals hit DEX and automated market maker Balancer for $128 million.

And this week, criminals targeted popular bridge Hyperbridge, exploiting the protocol to mint $1.2 billion in counterfeit crypto. Still, they only managed to pinch $237,000 due to liquidity issues.

Hackers last year made away with record amounts of cash by targeting DeFi protocols. To be sure, the lion’s share of the money stolen was from centralised exchanges.

David Schwed, a cybersecurity expert chief operating officer of Near protocol infrastructure firm SVRN, told DL News following the Drift hack that DeFi protocols need to put more energy into improving their security.

Mathew Di Salvo is a news correspondent with DL News. Got a tip? Email at [email protected].