Velocity Replaces Drift After the 285 Million Dollar Hack: What Changes for Investors in Germany

The perpetuals venue Drift on Solana has been called Velocity since its relaunch, and since September 29, 2026 a different team has been running it. Co-founder Cindy Leow has stepped back from her role, five months after attackers pulled around 285 million dollars out of the exchange's vaults on April 1. For you this is more than a change of name: trading is now settled in USDT instead of USDC, several functions have disappeared, and there is still no MiCA authorization for the German market.

A perp DEX is a decentralized exchange for open-ended futures contracts where you bet on price moves with leverage without owning the coin itself. The money does not sit with a bank; it sits in smart contracts, the so-called vaults. Those vaults were exactly what the April attack went after.

Velocity replaces Drift: the relaunch in numbers

The way back came in stages. On September 17, 2026 the project opened up its source code. On September 21 the whitelist fell, which until then had let only selected accounts trade, and the public beta was open to everyone. On September 29 the change at the top followed.

Leow explained her departure on X by pointing to the phase the project is now in. Her strength, she said in substance, lies in building from zero to one, and Velocity now needs people who take it from one to ten; she trusts this team to do that. Five names are taking over: a lead for fund recovery and law enforcement, a protocol engineer who previously headed the Helium Network, a product chief with a Binance background, a partnerships lead and a growth lead who comes from Binance and Trust Wallet.

The scale involved can be read off the back story. Before the attack, Drift had handled more than 150 billion dollars in trading volume, according to figures from around the project. Solana's perp platforms together reached 1.08 trillion dollars in cumulative volume by August 2026. Its own token, DRIFT, trades at around 0.019 dollars at the turn of the month, far below the big names; on the market-value ranking it sits around position 1,080.

The April 1 attack: 285 million dollars out of the vaults

On April 1, 2026 around 285 million dollars flowed out of the vaults. Before the attack more than 550 million dollars were locked in the protocol, so the outflow amounted to roughly half of the total value deposited. TVL, short for total value locked, describes the sum of all deposits sitting in a protocol's contracts.

That figure puts the case in order of magnitude. In September 2026, losses from crypto attacks across the industry added up to 766 million dollars. A single incident of 285 million dollars therefore belongs in the top category of what has happened this year, and the venue it hit was among the most active in the Solana ecosystem.

Fake collateral token: the attack path in detail

The technical lever was a forged collateral token. Collateral is the security you post so the exchange allows you a leveraged position; the contract weighs its value against your risk. If a worthless token can be made to count as valuable security, a real payout can be drawn against thin air.

What came before that was social engineering rather than a technical break-in. According to the project's account, the attackers obtained administration rights by building trust over months and manipulating people. Leow spoke of an infiltration prepared over six months. This is the part that code alone cannot catch: where a human grants the permission, the human is the point of attack.

For you as a user of a trading venue, that leads to an uncomfortable insight. A protocol can be cleanly written and audited several times and still fall because someone with elevated rights was deceived. Anyone who leaves a balance sitting on an exchange permanently carries that risk too. An overview of which venues come into question for perpetuals at all, and how they are set up on custody and safeguards, is in our comparison of perp DEXs.

North Korea attribution: what Mandiant and TRM Labs record

The forensics firms Mandiant and TRM Labs trace the attack to an actor with links to North Korea. Leow herself called it a state-level attack. The difference between attribution and proof matters here: such analyses rest on traces in transaction chains, on recurring tools and on patterns in how the perpetrators work. No court has ruled on it, and the firms frame their results as an assessment.

For judging the case, the attribution remains significant all the same. State-backed groups work with longer lead times and larger means than opportunists. Anyone using a venue that comes into the sights of such groups cannot assume that an audit alone is enough.

Tether puts up 127.5 million dollars: how the rescue package was built

Two weeks after the attack, on April 16, 2026, the funding for the return was in place. Tether committed up to 127.5 million dollars, and further partners contributed 20 million dollars. In total, up to 147.5 million dollars were available, so just under 150 million and about half of the outflow.

That calculation is the reason the relaunch was possible at all, and at the same time the point where you should look closely. A package of around 147 million dollars does not cover 285 million dollars. How the funds were allocated to deposits in detail, and which claims have been met and to what extent, cannot be derived from the public statements. Anyone who held a balance on the platform at the time should therefore check their own position directly in their account and not through third-party summaries.

It is also worth noting who steps in here. A stablecoin issuer and a number of private partners carried the case. No deposit guarantee fund set up by law was involved, and no legal obligation required anyone to step in. Precisely this difference from the regulated world is the core of what counts for you in Germany.

USDT instead of USDC: the change in settlement

Velocity settles differently from Drift. Settlement, meaning the currency in which gains, losses and collateral are booked, now runs through Tether's USDT rather than Circle's USDC. Spot markets remain only for collateral, for securing loans and for lending; trading itself concentrates on perpetuals.

The change has practical consequences. If you hold USDC, you need a conversion step before you can trade, and every swap costs a fee and time. On top of that, issuer risk shifts: in settlement you depend on the creditworthiness and the reserve policy of a different issuer. Both stablecoins are large, USDT leads the stablecoin ranking by market value and trades steadily at around one dollar, but it is a different promise from a different company.

The narrower range of functions is a deliberate choice. Fewer products mean fewer interfaces at which something can go wrong. Anyone who was looking for isolated markets or leveraged products outside perpetuals will no longer find them here and has to use another venue.

OtterSec and Asymmetric Research: 154 findings in the audit

Before the relaunch, the team had the code reviewed. OtterSec carried out the security audit and noted 154 findings, none of which the report classes as critical. Asymmetric Research took on operational security, meaning processes, rights management and the handling of keys. Since September 17 the code has been open, so third parties can look for themselves.

154 findings sound like a lot and are not. An audit report lists every observation, from the stylistic note to the genuine bug, and the classification into severity levels carries the information. The second part of the finding is what counts: that no finding is rated critical covers the program code. What a code audit does not cover is the April attack path, which ran through deceived people and granted rights. Operational security review stands for that, and its results are harder to judge from outside than a list of code findings.

How resilient a venue is shows up for you in three verifiable things: whether audit reports are public and dated, whether the code is open, and whether anyone is liable for failures. Velocity meets the first two points. On the third it gets thin, and here it helps to look at regulated crypto exchanges, whose duties are written into law.

Perp DEX without MiCA authorization: the legal position for German users

MiCA, the EU regulation on markets in crypto-assets, has governed step by step since 2024 who may offer crypto services in the European Union. A provider with authorization is subject to requirements on own funds, separation of client money, complaints procedures and supervision by an authority; in Germany that is BaFin. Which duties this brings for companies is something we have set out in our overview of the MiCA license and its obligations.

Velocity does not operate as an authorized provider in the EU. MiCA's protections therefore do not apply to you. There is no authority you can turn to in a dispute, no legal duty to separate client money and no deposit guarantee. The fact that private funds were collected in April shows the difference clearly: there, companies decided voluntarily; here, an authority would have set requirements.

At decentralized futures venues this is the rule. The same position applies at Hyperliquid, which is also reachable from Germany without MiCA authorization. Technically usable and legally protected are two different things.

Leverage and liquidation: the risk is unchanged

The relaunch has changed nothing about the product itself. A perpetual runs without an expiry date, and the funding rate balances the difference from the spot price at regular intervals; depending on market conditions you pay it or receive it. Liquidation means the exchange closes your position automatically as soon as your collateral no longer covers the losses. At high leverage, a price move of a few percent is enough for that.

The market around it is calm at the moment, and that is easy to misread. Solana trades at around 118 dollars at the turn of the month and has gained roughly 63 percent in two months, up from about 73 dollars. DeFi deposits on Solana stand at 6.5 billion dollars again, a gain of 38 percent in two months. Count the recovery in SOL rather than in dollars, however, and it looks smaller: with a 63 percent price gain and a 38 percent rise in dollar value, there is on balance rather less SOL in the protocols than before. A rising dollar figure is no proof that confidence has returned.

Tax on perp gains: the holding period does not apply here

With crypto-assets you hold directly, a gain is tax-free in Germany after a holding period of one year; within the year the threshold for private disposals applies. This logic comes from section 23 of the German Income Tax Act and assumes that you bought and sold an asset.

With a perpetual you do not buy the coin. You hold a futures contract, and gains from it are regularly treated as investment income under section 20 of the German Income Tax Act, with the flat-rate withholding tax and the offsetting restrictions that apply there for losses from futures transactions. There is no holding period after which something becomes tax-free. How an individual case is classified depends on your overall situation, and the legal position on futures transactions is in flux; this text does not replace tax advice. What you need regardless is a complete record of every position, and that calls for clean documentation of every position.

Velocity and Drift: Your next three steps

1. Clarify your old account balance. If you held a balance on Drift in April, call up your position in the account yourself and note what of your claims has been met. The rescue package of up to 147.5 million dollars does not fully cover the outflow of 285 million dollars, and outside summaries are no substitute for your own look; to document your positions, use tax tools and portfolio trackers.
2. Plan for the settlement switch. Work out what converting USDC into USDT costs you in fees, and decide how much balance you want to leave permanently on an exchange without MiCA authorization. Alternatives under statutory supervision are in the comparison of regulated crypto exchanges.
3. Separate holdings from the exchange. What you hold long term belongs in your own custody; only the funds for open positions stay on the venue. Which devices are suitable is shown by the hardware wallet comparison.

The primary source on the relaunch is the exchange's own site, Velocity. The figures on the outflow and on the recovery of deposits on Solana were compiled by Crypto Briefing.

(As of October 1, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)