The Drift exploit and what it means for Pyra users At 16:05 UTC on April 1st, 2026, the Drift protocol suffered an exploit, causing the loss of $285M+ of Drift’s user funds. Pyra user funds are held in Drift for yield and credit, so all Pyra user funds are affected. Drift has suspended deposits/withdrawals while they coordinate with security firms, bridges, and exchanges. We have also suspended card spend and new sign-ups while the incident is ongoing. Any new deposits to Pyra deposit addresses will not be routed into Drift, and instead will remain in the user’s self-custody keypair, which can be exported at any time in the Pyra app. We will continue to monitor updates from Drift and the wider security investigation as they come in. We have also begun the process of changing credit providers to move away from Drift and get back online as soon as possible. As user funds have been lost in the Drift exploit, they are not currently available to withdraw in the Pyra app. The balance displayed in the Pyra app is your balance in Drift’s ledger, not what tokens actually remain in the pool. What’s next? - The attacker used bridges and exchanges while funding the wallet and withdrawing stolen funds, which provides avenues for their identity to be tracked - The attacker also used Phantom, which tracks IP and other information of all users, also helping investigators track them down - Other exploits have been reversed in the past, such as the ByBit and Loopscale hacks in 2025, where all stolen funds were returned. If funds are recovered, Pyra deposits will become available again once Drift lifts the suspension. Thank you to everyone for your patience and understanding as we work through this. We hope to get this resolved as soon as possible. If you have any questions, please reach out through our Telegram group.