DeFi payments platform shuts after $286M exploit

TLDR

A crypto payments platform called Pyra is shutting down after being caught in the fallout from a roughly $286 million exploit of Drift Protocol.

1. Pyra has halted new users, cancelled cards, and set a 15 September 2026 deadline for customers to withdraw funds or export private keys via a dedicated portal.
2. The closure stems from the April 1 Drift exploit, a suspected DPRK-linked attack that left about $295 million in user losses and forced a long recovery process.
3. Users should track Pyras recovery token distribution plans and treat any DeFi payment card or bank-like product as exposed to protocol-level smart contract risk.

Deep Dive

1. What Happened To Pyra

Pyra, a crypto payments platform that issued cards and handled on-chain payments, is winding down operations after months of trying to recover from losses tied to the April 1 Drift Protocol exploit, which saw roughly $286 million stolen in a suspected DPRK-linked attack. One detailed report notes Drift now models around $295 million in outstanding user losses and a bespoke recovery pool.

Pyra has already stopped onboarding, cancelled all payment cards, and is giving users until 15 September 2026 to either withdraw remaining assets or export private keys via a web portal that will stay online for that purpose.

2. How The Drift Exploit Forced A Shutdown

Drifts exploit caused its total value locked to fall from about $550 million to under $250 million as the attacker swapped assets into USDC on Solana and bridged to Ethereum, severely damaging the protocols balance sheet and user confidence. Pyras business depended on Drift and its solvency, so unrecovered losses and a complex, slow recovery process left Pyra unable to continue operating as a going concern.

Drift plans a dedicated recovery token and pool, separate from any existing DRIFT token, but specifics on timing, tokenomics, and how much individual users (or partners like Pyra) will recover remain unresolved.

3. Broader DeFi Payments Risks And What To Watch

Security firm data shows DeFi protocols have already lost over $1 billion to hacks in 2026 alone, with more than 2,150 incidents logged and exploits spanning AMMs, rollups, and bespoke token contracts. Recent analyses underline that even small code mistakes can drain liquidity.

For Pyra users, the immediate priority is to meet the 15 September 2026 deadline to safeguard funds and keys, then monitor official updates on Drifts recovery token mechanics and distribution schedule via the portal. More broadly, anyone using DeFi-linked cards or payment apps should check which protocols back them, whether those protocols have had past exploits, and how recovery and insurance are structured.

Conclusion

Pyras shutdown shows how a large exploit at a core DeFi protocol can ripple outward to consumer-facing products, even months later. The episode reinforces that payments wrapped around smart contracts still carry protocol risk, and that users need to understand not just the app they see, but the DeFi layers underneath it.