Research guide
Drift to Velocity: A Solana Perps Post-Mortem Checklist
How to evaluate Drift's exploit, rebuild, and Velocity transition without turning a dated incident into either a permanent verdict or a trust reset.
- Updated
- Updated 2026-09-22
Quick answer
Drift's exploit and the subsequent Velocity direction belong in Solana's perps history because they change how readers should interpret track record, migration, and “new” branding. The right output is a dated post-mortem and current-status check, not a permanent ban or an automatic clean slate. This is editorial context, not a current quote. Verify changing product facts with the protocol before acting.
Last updated: September 22, 2026 — Answer framing and editorial context reviewed; dated product facts remain subject to the linked primary source.
Key takeaways
- An exploit history is evidence about a system under stress, not a complete current safety verdict.
- The important questions are root cause, remediation, affected balances, governance, audits, and whether the rebuilt product is the same risk surface.
- A new brand does not erase old architecture, operators, dependencies, or user-recovery obligations.
On this page
Drift’s exploit and the subsequent Velocity direction belong in Solana’s perps history because they change how readers should interpret track record, migration, and “new” branding. The right output is a dated post-mortem and current-status check, not a permanent ban or an automatic clean slate.
What the post-mortem must establish
- root cause and affected component;
- exact user impact and recovery process;
- whether the relevant contracts, keys, or risk engine changed;
- independent audit or review of the rebuilt system;
- current product availability, liquidity, custody, and exit path;
- what users must migrate or re-authorize.
Use the perps category and Perp DEX Rankings for current venue comparisons. Do not treat an old Drift page, a Velocity announcement, or a social summary as proof of current safety.
How should a trader evaluate the rebuild?
Start with the contracts and custody path that hold or control current user funds, then compare them with the exploited system. A new brand matters only when the rebuild changes the vulnerable component, key permissions, oracle path, recovery process, and independent review record.
What should users verify before reconnecting?
Verify the official domain, current contract addresses, withdrawal and migration instructions, audit scope, governance permissions, and live exit liquidity. Revoke old approvals that are no longer required and do not assume an old wallet connection or position automatically maps to the rebuilt product.
Frequently asked
Does a rebuild make a perps venue safe?
No. A rebuild can change the risk surface, but users still need to inspect the new contracts, custody, oracle, governance, audits, and recovery record.