Drift Protocol sent on-chain messages to four ETH wallets holding stolen funds, publicly naming suspects after a 53% TVL crash. Here’s what we know.
Drift Protocol has gone public. The DeFi platform sent on-chain messages to four Ethereum wallets believed to be holding funds from its recent exploit. The move came early April 3, 2026, as the team said critical information on the parties involved had been identified.
All four messages were sent from address 0x0934faC45f2883dd5906d09aCfFdb5D18aAdC105, according to Drift Protocol on X. The team stated it is ready to speak and asked the wallets to reach out through Blockscan chat.
Four Wallets, Four Timestamps, One Message
The first message went to wallet 0xAa843eD65C1f061F111B5289169731351c5e57C1 at 05:17 UTC. Wallet two, 0xD3FEEd5DA83D8e8c449d6CB96ff1eb06ED1cF6C7, received theirs at 05:20 UTC. The third address, 0xbDdAE987FEe930910fCC5aa403D5688fB440561B, was messaged at 05:23 UTC. The fourth, 0x0FE3b6908318B1F630daa5B31B49a15fC5F6B674, got the message at 05:25 UTC.
Drift said third-party attributions are still in progress. Further updates will follow once that process wraps up. The team kept the message direct and brief, telling suspects the door is open.
This comes days after the Drift Protocol exploit suspended platform operations and pushed TVL down over 53%, from $550 million to roughly $255 million. DRIFT token fell nearly 35% following the breach.
Will the Funds Ever Come Back?
Community members have already started asking harder questions. On X, user @dougline123 asked whether hackers have ever voluntarily returned stolen funds throughout history, and what plan exists to cover the 50% TVL shortfall.
It is not unheard of. Some exploiters have returned funds after on-chain negotiations. The 2021 Poly Network hack saw over $600 million returned after similar direct communication.
Still, no guarantee exists. Drift has not published a recovery or compensation plan as of this report. The community is watching the Blockscan chat closely.
What On-Chain Messaging Actually Does
Sending a message on-chain to a suspected exploiter is not new. It is a pressure tactic. It signals that investigators know who they are looking for, or at least where the funds sit.
It also creates a public record. Every wallet address, every timestamp, now lives on-chain permanently. That complicates any attempt to move or launder the stolen ETH without triggering further attention from exchanges and security firms.
Drift is coordinating with multiple security teams. The system blocked withdrawals to the affected business’s hot wallet entirely.
