Solana’s DeFi total value locked has climbed back above $6.5 billion, a level last seen before hackers drained $285 million from Drift Protocol in April. The recovery took six months and required a Tether-backed compensation pool, a full protocol rebrand, and a 63% run in SOL’s price.

Key Takeaways

  • Solana DeFi TVL has risen 38% in two months to top $6.5 billion, according to Crypto Briefing.
  • The recovery follows an April 1 exploit that drained $285 million from Drift Protocol, an attack linked to North Korean group UNC6862, per LeoDex News.
  • Tether committed up to $127.5 million to a revenue-backed recovery pool, with additional partners adding $20 million.
  • Drift rebranded as Velocity DEX, and co-founder Cindy Leow resigned on September 29, the same day as the platform’s full public relaunch.
  • SOL rose from roughly $73 to $118 over the same two-month window, a move that inflated dollar TVL even as token-denominated deposits may have slipped.

The exploit and the drawdown

Drift Protocol lost $285 million on April 1 when attackers used a fake collateral token to manipulate admin privileges and drain vaults, according to Crypto Briefing. The protocol held more than $550 million in TVL going into the attack, meaning the exploit wiped out roughly half its locked value. LeoDex News attributes the breach to UNC6862, a group it describes as Lazarus-affiliated, citing Crypto Briefing’s reporting. The hack forced the platform offline entirely and pulled double-digit percentage drops across Solana’s broader DeFi ecosystem as users withdrew from multiple protocols at once.

How the capital came back

Tether announced on April 16, roughly two weeks after the breach, that it would commit up to $127.5 million to a revenue-backed recovery pool, per Crypto Briefing. Other partners added another $20 million, bringing total pledged recovery capital to close to $150 million. Instead of immediate reimbursement, affected users received recovery tokens, giving them a claim on future protocol revenue rather than an upfront payout. LeoDex adds that the rebuild went beyond compensation: the team hired OtterSec for security audits, rotated all keys, redesigned the community multisig structure, open-sourced the codebase, and deployed a new program address. It also secured a separate Tether credit line to manage liquidity.

The protocol relaunched as Velocity DEX, shifting focus to perpetual contracts with tightened admin controls around vault operations. LeoDex reports the formal rebrand came in July, with private beta testing running through mid-2026 before a full public launch in September that made USDT settlement the default. Co-founder Cindy Leow’s exit landed on September 29, the same day as that relaunch, closing out a tenure LeoDex puts at five and a half years. Leadership now sits with David and Noah Prince, both with prior experience at Binance, per LeoDex’s sourcing.

Price did more work than deposits

SOL moved from about $73 to $118 over the two-month stretch, a 63% gain, according to Crypto Briefing. That run mechanically lifts dollar-denominated TVL across every Solana protocol without requiring a single new deposit. A 38% rise in TVL against a 63% price gain implies the actual quantity of SOL locked in DeFi may have edged lower over the period, even as the headline dollar figure recovered. Coinfomania frames the $6.5 billion mark as the first time TVL has reached that level since the hack and cites commentary from trader @SolanaFloor pointing to renewed confidence in Solana as a DeFi venue. Pluang reports SOL’s price ticked down 0.63% over the 24 hours to September 30 even as the TVL recovery held, with a circulating supply of 588 million SOL and 71% of Pluang order flow on the buy side.

An open question on structure

The exploit exposed a weakness that sits outside smart contract code: protocols relying on admin keys, thin multisig signer sets, or concentrated governance remain exposed no matter how many audits they pass. Crypto Briefing notes the recovery token model, paying victims out of future revenue rather than reserves or dilution, sets a template other protocols may study after their own incidents. Whether Velocity DEX’s post-hack architecture, or its new leadership under the Prince brothers, holds up under future stress is not something the current numbers can answer. The TVL recovery shows capital has returned. It does not by itself show the underlying vulnerability has been closed for good.

Sources