After the damage: Drift's recovery token, XRPL vault refills and a Bitcoin Core signing guard

Serguey Asael Shinder05 October 2026, 07:182 min read

Three pieces of crypto infrastructure moved this week, each about the same moment: what happens after something has already gone wrong.

When a protocol is hacked. Drift opened redemptions for DFX, the token it gave victims of its April exploit, one per dollar of verified loss. At launch the pool paid about 0.0104 USDT per token, roughly one cent per dollar. Redeeming burns the token and ends its share of future deposits from trading revenue and recovered funds; holding keeps that claim. The loss is converted into a long-dated bet on the protocol's recovery, and each victim chooses when to stop betting.

When a loan defaults. On the XRP Ledger, a vault that lent out everything and saw the loan default is left with shares and no assets. The draft XLS-65.4 lets the vault owner donate assets back without minting shares, so existing shareholders are restored and new depositors are not diluted by worthless shares. It puts the cost of a bad loan where the owner chooses to put it, and it is voluntary.

When a signature commits to too little. Bitcoin Core now refuses to sign SIGHASH_SINGLE inputs that have no matching output, because such a signature remains valid even if the payment's destination is swapped. This one prevents the damage instead of distributing it: the check now sits in shared signing code, so every signing path inherits it.

The pattern. The three responses map onto three choices. Drift spreads a realised loss across time and lets each victim price it. The XRPL draft gives the party responsible for the loss a clean tool to absorb it. Bitcoin Core removes a way for the loss to happen at all. Only the last needs no one to make a decision afterwards, which is why such guards keep moving into shared code where nobody can forget to call them.

What it means

For users, the useful question about any protocol is not only how it prevents failure but what it does after one: who absorbs the loss, on what timetable, and by whose choice. Recovery tokens and owner donations are honest about that, but both depend on future money or goodwill. A refused signature depends on neither.