This page was compiled by Blockworks using publicly available information reviewed consistent with the TTF, possibly together with information supplied directly by the project where provided. Project-supplied information may correct, update, or supplement the public record, and may not be independently verifiable; Blockworks presents it as provided and does not verify or warrant its accuracy. Because this page depends on what has been disclosed, it may be incomplete — certain categories are more likely to include undisclosed items (e.g., non-announced fundraisings or material relationships), and the absence of an entry should not be read as confirmation that none exists.
Provide a concise narrative that clearly states each of (a)–(e) below.
Response
Velocity Exchange, formerly Drift Protocol, is a decentralized exchange on Solana that lets users trade perpetual futures and spot assets and lend and borrow from onchain accounts without a custodian. It launched as Drift on Solana in late 2021 after a $3.8 million seed round and was built to offer exchange-grade derivatives trading with onchain settlement. After an April 1, 2026 exploit drained about $295.7 million from Drift, the exchange was rebuilt and rebranded as Velocity Exchange, with the rebrand announced on July 1, 2026 and open access restored after the whitelist was removed on September 21, 2026. The governance token keeps the DRIFT name, and the Drift DAO, Drift Foundation and Drift Labs keep their names, so this filing refers to them as such.
(Source: CoinDesk, Drift Raises $3.8M, Solana Compass, Drift Co-Founder Cindy Leow Steps Down, The Crypto Times, Drift Rebrands to Velocity, Incident Recovery Update)
Development has been funded by venture rounds totalling $52.5 million and by protocol fees. DIP-9, put to a vote from December 24, 2025, proposed paying Drift Labs and associated contributors $1.5 million a month from protocol fees for two years, with a $9 million USDC payment for the first half of 2026. Since the exploit, the priority is recovery for affected users. Velocity routes 60% to 90% of its Net Protocol Revenue to the DFX recovery pool, and Tether committed up to $127.5 million, including a revenue-linked credit facility, with partners committing up to $20 million more.
(Source: Drift Raises $25M in Series B, DIP-9 Support Ongoing Protocol Development and Growth, DFX Claim and Redemptions, Incident Recovery Update)
Users deposit collateral into onchain accounts and trade perpetual futures and spot markets, with margin, liquidation and risk rules enforced by the exchange program. Fees are split between the Insurance Fund, the liquidity pool and protocol revenue. In the rebuilt Velocity Exchange, 15% of fees go to the Insurance Fund, 15% to the vAMM and 70% to Net Protocol Revenue. Velocity runs on a new program address with rotated keys, and Isolated Markets and Amplify were removed in the relaunch.
(Source: DFX Claim and Redemptions, Recovery Plan for Affected Users, DIP-8 Update to Trading Fee Distribution)
DRIFT is the governance token of the Drift DAO. Holders vote on Drift Improvement Proposals on Realms at one token per vote, and a holder needs 20,000 DRIFT to submit a proposal. DRIFT was also used to pay ecosystem rewards, including the 2024 launch airdrop and the FUEL rewards program. Before the exploit, DRIFT could be staked in the Drift Safety Module, which gave stakers fee discounts and a role in voting, and the FUEL Claim & Stake option paid a bonus of up to 1,000 DRIFT to claimants who staked there. DRIFT carries no claim on protocol revenue. The Velocity Insurance Fund staking documentation covers stakes in market assets only and does not provide for DRIFT staking.
(Source: Introducing the DRIFT Governance Token, Drift Constitution, FUEL Claim, Insurance Fund Staking)
Governance has three branches. The Realms DAO elects Security Council members, after the Foundation appointed the first Council under its Bylaws. The Security Council sets risk parameters and approves program upgrades and market listings, and a futarchy DAO run through MetaDAO funds grants. The April 2026 exploit came through takeover of the Security Council multisig, and Drift said it would introduce a new community-governed multisig with signers on dedicated signing devices. Velocity now uses cold, warm and hot admin key tiers, with warm changes behind a timelock. On September 30, 2026 the Drift Foundation said it is evaluating the best path forward for DRIFT, so the token's future role in governing Velocity is undecided as of 2026-10-12.
(Source: Introducing the DRIFT Governance Token, Drift Constitution, Incident Recovery Update, Admin Keys, Drift Foundation on X)
For each existing entity: Labs/DevCo (e.g., Founder, CEO, CTO, COO), Foundation (e.g., President, Executive Director, CFO, COO), and DAO / onchain governance leadership (if applicable) list the: (a) full names, (b) official titles, (c) and prior experience of key team members. For any non-existent entity, explicitly mention it does not exist. External links may be included but they will not factor into the score.
Response
Full Name | Entity | Official Title | Prior Experience |
|---|---|---|---|
Cindy Leow | Labs/DevCo | Co-founder of Drift, who stepped down from Velocity Exchange on September 29, 2026 (Solana Compass) | Portfolio manager at 256 Capital from 2019 to 2021 and advisor at Softbank Korea from 2017 to 2018 (IQ.wiki, Cindy Leow) |
David Lu | Labs/DevCo | Co-founder of Drift, continuing asset recovery and law enforcement work with the Foundation (Solana Compass) | Co-founder of Textbook Ventures from 2016 to 2018 and managing partner at a hedge fund from 2018 to 2021 (IQ.wiki, David Lu) |
Chris Heaney | Labs/DevCo | Co-founder of Drift (Solana Compass) | Prior experience is not disclosed in the Drift and Velocity sources reviewed. |
Noah Prince | Labs/DevCo | Head of Protocol (Drift Recovery Update June 3, 2026) | Head of Protocol Engineering at Helium, where he led its migration to Solana (Drift Recovery Update June 3, 2026) |
Matt Shaw | Foundation | Independent Director of the Drift Foundation (Introducing the DRIFT Governance Token) | Prior experience is not disclosed by the Drift Foundation, and no public profile could be tied to this director with confidence (Drift Constitution). |
Webslinger (firm) | Foundation | DAO Administrator of the Drift Foundation (Introducing the DRIFT Governance Token) | Webslinger is described as an advisory firm, and no individual at the firm is named (Introducing the DRIFT Governance Token). |
Security Council members | DAO/Onchain Governance | Security Council of at least five members, established by the Foundation and appointed under the Bylaws, with tokenholders electing replacements (Drift Constitution) | The members of the Security Council are not publicly named in the Constitution, the governance forum or the incident updates (Drift Constitution). |
Nick Almond | DAO/Onchain Governance | Delegate for Jito, one of eleven delegates proposed to receive 13 million DRIFT in delegated votes under DIP-7, alongside MetaDAO, Blockworks Advisory, Pine Analytics, Sanctum and others (DIP-7) | Head of Governance at Jito, responsible for supporting Jito DAO (DIP-7) |
Provide a structured description of the DAO's governance, powers, and economic rights. If a DAO does not exist, state so. Address the lettered items below. Even if there is no DAO, there must be an answer to (d).
Response
The DAO does not own or control the codebase or brand. The Constitution contains no provision on intellectual property. The Velocity Exchange Terms of Use state that Lumen Collective Ltd, trading as Velocity Exchange, and its licensors own all rights in the Services, including the associated intellectual property. Velocity published its program code and the OtterSec audit on September 17, 2026, and code such as the airdrop distributor sits in the velocity-exchange GitHub organization, which is controlled by the Velocity team rather than the DAO.
(Source: Drift Constitution, Velocity Exchange Terms of Use, Solana Compass, Drift Co-Founder Cindy Leow Steps Down, Velocity Distributor)
Tokenholders vote on Realms at one token per vote. A proposal needs 20,000 DRIFT to submit and passes when at least 2% of circulating supply votes yes and yes votes exceed no votes, after a 4-day voting period, a 2-day cooldown and a 2-day hold-up. DIP-7 proposed raising the Realms quorum from 3 million to 6 million DRIFT. The Security Council has at least five members appointed under the Foundation Bylaws, with tokenholders electing replacements, and a meeting quorum of three. It approves program upgrades, sets risk parameters and lists markets, and can take emergency actions that bypass a tokenholder vote. Foundation Directors can veto offchain actions that conflict with law or the Foundation's purpose. On March 26, 2026 the Security Council multisig was migrated to a 2-of-5 threshold with no timelock, which the attacker used on April 1, 2026. Velocity now uses cold, warm and hot admin keys and a pause-only key, and does not publish key custody or signing thresholds.
(Source: Drift Constitution, DIP-7, Chainalysis, Lessons From the Drift Hack, Admin Keys)
DRIFT has no locking or vote-escrow mechanism that grants added governance rights. Voting power is one token per vote, and delegated tokens vote with the same weight as directly held tokens.
(Source: Drift Constitution, DIP-7)
DRIFT holders have no right to receive protocol revenue. Governance can set fee splits through DIP-T proposals, and DIP-8 proposed sending 10% of trading fees to the Insurance Fund, 10% to the liquidity pool and 80% to collected protocol fees. On Velocity, 70% of fees become Net Protocol Revenue, and 60% to 90% of that is routed daily to the DFX recovery pool for exploit victims rather than to DRIFT holders. No DRIFT buyback has been adopted. DIP-8 anticipated that a later DIP-9 could discuss a buyback, and the November 2025 tokenomics update opened forum discussion on using excess protocol fees to acquire DRIFT. Before the exploit, DRIFT staked in the Drift Safety Module earned fee discounts.
(Source: Drift Constitution, DIP-8 Update to Trading Fee Distribution, DFX Claim and Redemptions, Update to Drift Tokenomics November 2025, FUEL Claim)
The Constitution sets no process for dissolving the DAO or winding up the Drift Foundation. As a Cayman Islands foundation company, the Foundation would be wound up under its Bylaws and Cayman law, and the Bylaws are not published. No tokenholder vote threshold for dissolution is disclosed.
(Source: Drift Constitution)
For the Primary Foundation do the following independently. If an entity does not exist, state that explicitly. Items (a)–(f) apply only if that entity exists; state explicitly that the entity doesn't exist. Definitions: The primary Foundation and DevCo can be explained as those entities which are directly involved in the issuance of the native token at launch.
Response
The Primary Foundation is the Drift Foundation, a Cayman Islands foundation company with Directors, a Supervisor and an Administrator. Matt Shaw is the independent Director, and the advisory firm Webslinger is the DAO Administrator.
(Source: Drift Constitution, Introducing the DRIFT Governance Token)
The Foundation does not disclose owning the code or the Drift or Velocity brands, and no subsidiary of the Foundation is disclosed. The Velocity Exchange Terms of Use name Lumen Collective Ltd as the owner of the Services and their intellectual property. The Foundation runs the drift.foundation site, which hosts the Constitution and the airdrop and FUEL claim portals.
(Source: Drift Constitution, Velocity Exchange Terms of Use, FUEL Claim)
The Foundation's Directors approve offchain actions and can veto those that conflict with law or the Foundation's purpose. The Administrator reviews proposals for practicality and safety before they go to a vote. The Foundation posts DIPs, holds the Foundation token allocation, and under DIP-7 proposed delegating 13 million DRIFT of it to eleven delegates. DIP-10 proposed authorizing the Foundation to convert all remaining spot assets in the borrow and lend pool to stablecoins for the recovery pool, which held about 3.1 million USDT at the October 2026 launch of DFX claims. The DRIFT mint authority and freeze authority are both null, so no party can mint or freeze DRIFT.
(Source: Drift Constitution, DIP-7, DIP-10 Treatment of Remaining Asset in Borrow Lend, DFX Claim and Redemptions, Solscan, DRIFT Token)
The Foundation has no disclosed ownership of or board control over Drift Labs. Its influence is contractual and financial. DIP-9 describes the Foundation as a non-profit steward whose operating expenses Labs advances, and it proposed that the Foundation reimburse Labs from protocol fees, subject to Security Council adjustment and Labs publishing half-year financials.
(Source: DIP-9 Support Ongoing Protocol Development and Growth)
The Foundation does not hold a disclosed pause or upgrade key. Program upgrade approval sat with the Security Council multisig, which was set to a 2-of-5 threshold with no timelock on March 26, 2026. The Constitution lets the Security Council take emergency actions and lets Directors veto offchain actions. Velocity's admin keys are split into cold, warm and hot tiers with a pause-only key, and custody and thresholds are not published.
(Source: Drift Constitution, Chainalysis, Lessons From the Drift Hack, Admin Keys)
The Constitution pays each Security Council member $1,000 a month in USDC or DRIFT. DIP-9 proposed that protocol fees reimburse $1.5 million a month to Drift Labs and associated contributors for two years. The Foundation manages the DFX recovery pool, which receives 60% to 90% of Velocity Net Protocol Revenue and Tether and partner contributions, and distributes it to DFX holders until claims close on January 1, 2028. No mechanism directs revenue to the Foundation's own members.
(Source: Drift Constitution, DIP-9 Support Ongoing Protocol Development and Growth, DFX Claim and Redemptions)
For the Primary DevCo do the following independently. If an entity does not exist, state that explicitly. Items (a)–(f) apply only if that entity exists; state explicitly that the entity doesn't exist. Definitions: The primary Foundation and DevCo can be explained as those entities which are directly involved in the issuance of the native token at launch.
Response
The Primary DevCo is Drift Labs, the core contributor company that built Drift. Its legal entity type and jurisdiction are not disclosed in the Drift, Velocity or governance sources reviewed. The relaunched exchange is operated by Lumen Collective Ltd, trading as Velocity Exchange, under Terms of Use governed by the laws of the Republic of Panama with arbitration seated in Singapore. Lumen Collective's own place of incorporation is not stated.
(Source: DIP-9 Support Ongoing Protocol Development and Growth, Velocity Exchange Terms of Use)
Lumen Collective Ltd and its licensors own the Services and their intellectual property under the Velocity Terms of Use. The velocity-exchange GitHub organization holds the airdrop distributor program. Velocity published its program code with the final OtterSec audit on September 17, 2026, although the admin keys page still says the program will be open sourced once the post-fork audit report is final. No other subsidiary is disclosed.
(Source: Velocity Exchange Terms of Use, Velocity Audits, Admin Keys, Solana Compass, Drift Co-Founder Cindy Leow Steps Down, Velocity Distributor)
Drift Labs has no disclosed vote or veto in the DAO beyond any DRIFT its contributors hold. Its contributors hold tokens from the 25% Protocol Development allocation. Through the Velocity admin keys, the operator can change margin ratios, fee splits, oracle sources, pause states and market status.
(Source: Update to Drift Tokenomics November 2025, Admin Keys)
Drift Labs has no disclosed power to appoint Foundation Directors. DIP-9 states that Labs advances the Foundation's operating expenses, which gives Labs indirect influence over the Foundation's operations.
(Source: DIP-9 Support Ongoing Protocol Development and Growth)
Velocity uses a cold key for root changes such as replacing a market oracle, a warm key behind a timelock for routine changes, single-purpose hot keys, and a pause key with no timelock that can only add pauses. The page does not publish custody, multisig thresholds or timelock length.
(Source: Admin Keys)
DIP-9 proposed $1.5 million a month from protocol fees to Drift Labs and associated contributors for two years, with a $9 million USDC payment for the first half of 2026. Velocity Net Protocol Revenue, 70% of fees, is first routed 60% to 90% to the DFX recovery pool. Drift Labs contributors receive DRIFT from the Protocol Development allocation, which is 50% unlocked as of November 2025.
(Source: DIP-9 Support Ongoing Protocol Development and Growth, DFX Claim and Redemptions, Update to Drift Tokenomics November 2025)
Disclose launch and initial supply details in a single initial allocation schedule covering the token's launch.
Response
DRIFT launched on May 16, 2024 with a total supply of 1,000,000,000 tokens. The only tokens unlocked at launch were the airdrop tokens, made up of the 100,000,000 Launch Airdrop and a 20,000,000 bonus funded from the ecosystem allocation, for 120,000,000 in total. The remaining 880,000,000 were locked or held for release on a 5-year emission and vesting schedule.
(Source: Introducing the DRIFT Governance Token, Announcing the Details of the DRIFT Launch Airdrop, Eligibility Criteria)
The airdrop announcement describes 120,000,000 tokens, or 12%, because it counts the 2% bonus drawn from the ecosystem bucket.
(Source: Introducing the DRIFT Governance Token, Update to Drift Tokenomics November 2025, Eligibility Criteria)
No fixed price was set. DRIFT was distributed by airdrop and price was discovered on exchanges when trading opened on May 16, 2024, including KuCoin and Backpack. Prior rounds were equity-style raises with no disclosed per-token price. DRIFT traded at about $0.018 on 2026-10-12.
(Source: KuCoin, DRIFT Listing, Backpack Lists DRIFT, CoinGecko, Drift Protocol)
The ticker is DRIFT, an SPL token on Solana with mint address DriFtupJYLTosbwoN8koMbEYSx54aFAVLddWsbksjwg7.
(Source: Solscan, DRIFT Token, CoinGecko, Drift Protocol)
The supply is fixed at 1,000,000,000 DRIFT. The mint authority and freeze authority are null, so no new DRIFT can be minted, and the onchain supply was 999,998,338.08 DRIFT on 2026-10-12. Circulating supply was about 726,134,160 DRIFT as of 2026-10-12, against a circulating cap of 750,000,000 set in November 2025.
(Source: Solscan, DRIFT Token, CoinGecko, Drift Protocol, Update to Drift Tokenomics November 2025)
(Source: Introducing the DRIFT Governance Token, Update to Drift Tokenomics November 2025, Announcing the Details of the DRIFT Launch Airdrop, Claims for the DRIFT Governance Token Are Now Live)
Address each of the following sub-items based on the project's airdrop status. If a sub-item does not apply to the project's situation, state that explicitly.
Response
Planned but not yet executed airdrop
Not applicable. No new DRIFT airdrop is planned as of 2026-10-12, and both the Launch Airdrop and FUEL rewards have been distributed.
(Source: Update to Drift Tokenomics November 2025)
Executed airdrop
The Launch Airdrop distributed 120,000,000 DRIFT, made up of the 100,000,000 Launch Airdrop allocation and a 20,000,000 bonus from the ecosystem allocation. About 150,000 wallets were eligible. The allocation was weighted 64% to OG points for trading volume, Insurance Fund staking, deposits, borrows and backstop liquidity, 30% to Trader Points, 5.5% to Early Drifters who used v1 and 0.5% to keepers. Each eligible user received an initial allocation plus a bonus that vested linearly over 6 hours, and claiming early forfeited the unvested bonus to the DAO. Top Drifters with large allocations claimed part on day 1, with the remainder under a 3-month cliff and 9-month vest. Claims ran from May 16, 2024 to August 16, 2024 at 6pm UTC through drift.foundation, and about 8.2 million unclaimed tokens were rolled into FUEL. The FUEL program then distributed 16.3% of the 430,000,000 DRIFT ecosystem allocation, about 70.1 million DRIFT, linearly by FUEL points with no tiers, to over 22,000 wallets with at least 20,000 FUEL. Claims above 150,000 DRIFT vest over 12 months with a 3-month cliff, and claimants who used Claim & Stake into the Drift Safety Module by July 13, 2025 earned a bonus of up to 1,000 DRIFT. Per-address allocations are held in the open-source merkle distributor program at E7HtfkEMhmn9uwL7EFNydcXBWy5WCYN1vFmKKjipEH1x, whose distributor and claim status accounts expose amounts through Solana RPC, and the distributor API returns each wallet's allocation by public key.
(Source: Announcing the Details of the DRIFT Launch Airdrop, Claims for the DRIFT Governance Token Are Now Live, Eligibility Criteria, Eligibility Criteria, Updated FUEL Season 1 Claim, FUEL Claim, Velocity Distributor)
No airdrop planned or conducted
Not applicable. Drift conducted the 2024 Launch Airdrop and the FUEL rewards distribution described above.
(Source: Claims for the DRIFT Governance Token Are Now Live)
Projects must disclose all material terms of market-making arrangements that affect token liquidity. If the project has no agreements or deals with market makers, state that explicitly; doing so earns full credit. For each market maker, include in a table:
If the project has no agreements or deals with market makers, state that explicitly; doing so earns full credit. If no native tokens were loaned or allocated to market makers, state that explicitly; cash/fiat retainers or fees are not required for this item.
Response
Projects must disclose all material terms of centralized or decentralized exchange listings that affect token liquidity. For each listing, include in a table:
If the project has no agreements or deals with CEX or DEX, state that explicitly; doing so earns full credit; cash/fiat fee amounts are not required for this item.
Response
Disclose all prior token sales by the Project — including fundraising rounds, any material OTC sales to investors, and any discounted market-maker sales. For each sale, provide:
If no prior sales occurred, state that explicitly (e.g., "No prior fundraising, OTC, or discounted MM sales have occurred.").
Response
If any, list prior exploits or incidents that directly affected the token, token supply, tokenholder balances, token contract, minting controls, burn mechanics, or custody of token supply. This question is not asking about general protocol, application, or smart contract exploits unless the incident directly affected the native token itself. If no prior incidents, state this explicitly (e.g., "No exploits affecting tokenholders or protocol funds as of YYYY-MM-DD").
Response
The incident took place on April 1, 2026 on Solana. The attacker took over the admin authority of the Drift exchange program through the Security Council multisig and drained the protocol's custody of user assets. DRIFT tokens in custody were not taken, but the Security Council that controlled DRIFT governance operations was compromised and the DRIFT price fell.
(Source: Incident Recovery Update, Chainalysis, Lessons From the Drift Hack)
Over about six months, attackers posing as a quantitative trading firm socially engineered Security Council signers. From March 23, 2026 they obtained pre-signed transactions using Solana durable nonces, and on March 26 the Security Council multisig was migrated to a 2-of-5 threshold with no timelock. On April 1 the attacker used those transactions to transfer admin control, listed a fake CarbonVote Token as collateral with a manipulated oracle, removed withdrawal limits and withdrew assets. Drift said the attack did not exploit a vulnerability in its programs and that there is no evidence of compromised seed phrases. Mandiant attributed the attack to UNC6862, a North Korean actor.
(Source: Chainalysis, Lessons From the Drift Hack, The Hacker News, Drift Loses $285 Million, Drift Recovery Update June 3, 2026)
The attacker took $295,706,374.93 in assets, including $159.33 million of JLP, $71.42 million of USDC, $11.32 million of cbBTC and $10.43 million of SOL. 8,743,353.07 DRIFT remained in the protocol and was not stolen. The Insurance Fund was unaffected. The DRIFT price fell about 25% on the day.
(Source: Incident Recovery Update, FXStreet, Drift Protocol Suffers $280M Attack)
Drift paused the protocol, froze about 3.36 million USDC through Circle's CCTP and offered a 10% bounty, later run as a public bounty with Bybit. About $9.2 million more was frozen after the attacker moved funds through Tornado Cash in August 2026. Tether committed up to $127.5 million and partners up to $20 million. The exchange was rebuilt on a new program address with rotated keys, audited by OtterSec, and relaunched as Velocity with new admin key tiers and durable nonces disabled. DIP-10 proposed converting remaining borrow and lend assets to stablecoins for a recovery pool, and affected users received DFX tokens worth $1 of verified loss each, 299,500,810.998 in total, redeemable from the pool. Insurance Fund depositor assets became available for withdrawal on July 7, 2026.
(Source: Recovery Plan for Affected Users, Incident Recovery Update, DIP-10 Treatment of Remaining Asset in Borrow Lend, DFX Claim and Redemptions, Velocity Audits, Drift Foundation on X)
The incident is unresolved and under investigation as of 2026-10-12. The recovery pool held about 3.1 million USDT when DFX claims opened, an early redemption value of about $0.0104 per DFX, or about 1% of losses. The stolen funds were bridged to Ethereum as about 130,259 ETH across four wallets. As of the Foundation's September 30, 2026 update, three of those wallets had not moved and held 107,165 ETH, while about 23,094 ETH was sent into Tornado Cash on July 23, 2026. Recovered funds go to the DFX recovery pool, and DFX claims stay open until January 1, 2028.
(Source: DFX Claim and Redemptions, Recovery Plan for Affected Users, Drift Foundation on X)
The incident updates, the recovery plan and the DFX claim page are the primary references, and Chainalysis published an independent analysis.
(Source: Incident Recovery Update, Recovery Plan for Affected Users, DFX Claim and Redemptions, Chainalysis, Lessons From the Drift Hack)
Describe material risk factors across the three categories below. Each category includes prompts to address at a minimum.
(a) Regulatory, Legal & Tax Risks — Describe how evolving laws and regulations could affect the project by answering, at a minimum, questions like:
Impact of Regulatory Change on TGE and Listings: (If applicable) How could evolving or conflicting laws and regulations affect your ability to complete the TGE, deliver tokens to purchasers, and list or maintain the token on trading venues in key jurisdictions?
Entity-Level Regulatory Impact: (If applicable) How could regulatory or legal changes impact your core entities (Foundation, DevCo, DAO, affiliated service providers), including enforcement actions, licensing requirements, or forced changes to structure or operations?
Tokenholder Tax Treatment: (If applicable) What uncertainties exist around how tokenholders may be taxed, and make clear that tokenholders are responsible for understanding their own tax obligations?
Jurisdictional & User Access Restrictions: (If applicable) If the project restricts access for certain jurisdictions or user types (e.g., U.S. persons, sanctioned countries, retail vs. professional), what are those restrictions and what risks do they create for users and for the project?
(b) Protocol, Technology & Security Risks — Describe risks to network and contract reliability, correctness, and safety by answering, at a minimum, questions like:
Bugs and Design Flaws: (If applicable) What bugs, design flaws, or implementation errors could exist in your core protocol code, smart contracts, and any bridges, rollups, or oracles that you depend on, and how could these lead to loss of funds or disruption of the protocol?
Security Measures & Their Limitations: (If applicable) What security measures have you taken (audits, formal verification, bug bounties), and what types of failures might these measures still fail to detect or prevent?
(c) Token Economics, Unlocks & Incentive Risks — Describe how the token's economic design and supply schedule could affect holders by answering, at a minimum, questions like:
Critical Economic Assumptions: (If applicable) Which economic assumptions (e.g., staking yields, fee revenue, liquidity incentives, MEV capture, demand for blockspace) are critical for protocol security, utility, and governance, and what happens if those assumptions fail?
Governance Control over Monetary Policy & Rewards: (If applicable) To what extent can governance change monetary policy, fee parameters, or reward allocations (e.g., inflation rate, treasury flows, incentive programs), and how could such changes adversely affect tokenholders?
Response
Impact of Regulatory Change on TGE and Listings:
DRIFT launched in May 2024 and has no pending TGE, so regulatory risk falls on continued trading. DRIFT trades on centralized venues including KuCoin and Upbit, and a change in how regulators classify governance tokens or perpetual DEX tokens could lead venues to delist it. The token's role is also uncertain because the Foundation said on September 30, 2026 that it is evaluating the best path forward for DRIFT, which could change how exchanges treat the asset.
(Source: KuCoin, DRIFT Listing, CoinGape, DRIFT Upbit Listing, Drift Foundation on X)
Entity-Level Regulatory Impact:
The Drift Foundation is a Cayman Islands foundation company, and the Velocity operator, Lumen Collective Ltd, contracts under Panamanian law. Perpetual futures trading is a regulated activity in many jurisdictions, and new licensing or enforcement action against offshore derivatives venues could force Velocity to restrict more users or change its structure. The April 2026 exploit, attributed to a North Korean actor, involves law enforcement and sanctions-related recovery work, which adds legal exposure for the entities.
(Source: Drift Constitution, Velocity Exchange Terms of Use, Drift Recovery Update June 3, 2026)
Tokenholder Tax Treatment:
Tax treatment is uncertain for DRIFT received through the Launch Airdrop and FUEL rewards, for delegated or governance-related holdings, and for DFX recovery tokens received for exploit losses. The Velocity Terms of Use state that users are solely responsible for reporting and paying any taxes on their use of the Services. Tokenholders are responsible for understanding and meeting their own tax obligations in their jurisdictions.
(Source: Velocity Exchange Terms of Use, DFX Claim and Redemptions)
Jurisdictional & User Access Restrictions:
Velocity perpetual contracts are not offered to persons in the United States. The Terms of Use bar residents of restricted territories including Canada, the United Kingdom, Cuba, Iran, North Korea, Russia, Syria, Venezuela and the Crimea, Donetsk and Luhansk regions, plus FATF high-risk jurisdictions and sanctioned regions, and prohibit VPN use to get around these limits. These restrictions narrow the user base and can lead to account action for users who misstate their location.
(Source: Velocity Exchange Terms of Use)
Bugs and Design Flaws:
Drift has suffered two major failures. On May 11, 2022 the original Drift v1 was paused after $8.72 million of collateral was withdrawn in about 12 hours, caused by a withdrawal accounting flaw and unchecked leverage during the LUNA crash, and v1 was wound down with $19.5 million repaid to traders. On April 1, 2026 attackers used pre-signed admin transactions to take $295.7 million. Velocity's own audit found 154 issues, including 41 high-severity findings that were fixed, and the protocol depends on oracles and admin-set parameters that can fail.
(Source: Drift Incident Report Post-Mortem, Incident Recovery Update, Velocity Audits)
Security Measures & Their Limitations:
The protocol was audited by Trail of Bits and Neodyme before the fork and by OtterSec for Velocity, and it runs a bug bounty that pays up to $100,000 for critical findings. Velocity uses tiered admin keys with a timelock on warm changes and a pause-only key. The 2026 exploit came through social engineering of key holders, which audits and bug bounties do not cover, and Velocity does not publish key custody or signing thresholds. The disclaimer states the protocol is experimental and provided as is.
(Source: Velocity Audits, Bug Bounty, Admin Keys, Disclaimer)
Critical Economic Assumptions:
DRIFT has no revenue share, so its value depends on demand for governance over the exchange. Velocity must rebuild trading volume after the exploit, and 60% to 90% of its Net Protocol Revenue goes to DFX holders before it can fund anything else. Unlocks of Series B and Protocol Development tokens continue to add supply, with circulating supply at about 726 million of 1 billion DRIFT as of 2026-10-12.
(Source: DFX Claim and Redemptions, Update to Drift Tokenomics November 2025, CoinGecko, Drift Protocol)
Governance Control over Monetary Policy & Rewards:
DRIFT supply cannot be increased because the mint authority is null. Governance and the Security Council can change fee splits, contributor payments and reward programs, as with DIP-8, DIP-9 and the FUEL program, and the Foundation controls when treasury and ecosystem tokens are distributed. The Foundation's review of the best path forward for DRIFT could change the token's role in ways that hurt holders.
(Source: Solscan, DRIFT Token, DIP-8 Update to Trading Fee Distribution, DIP-9 Support Ongoing Protocol Development and Growth, Drift Foundation on X)
This Token Transparency Filing is provided for general informational purposes only and does not verify or warrant the accuracy of individual answers.
