Drift exploit wallets move $61.56M in ETH to Tornado Cash
In this article5 sections
Wallets linked to the April 1 Drift Protocol exploit deposited 25,700 ETH, worth about $61.56 million, into the mixer Tornado Cash over roughly two hours on Tuesday, according to Coincentral. The addresses had been inactive for about two months before the burst.
Coincentral cited Lookonchain, which posted the figures on X on Oct. 20, and Arkham Intelligence data showing the same pattern. Decrypt and Crypto.news reported the same deposit separately.
Key facts
- Lookonchain put the deposit at 25,700 ETH, about $61.56 million, made in batches of 100 ETH (roughly $237,800 each) plus smaller 10 ETH chunks that match Tornado Cash’s fixed pools.
- Arkham Intelligence tracks 71 addresses tied to the attacker, which still held 81,454 ETH after Tuesday’s transfers, plus about $561,600 in USDT, USDC, Solana and USDY.
- An earlier round on July 23-24 saw an address labelled Drift Exploiter 4 send about 23,095 ETH, then worth around $44.4 million, to the same mixer.
- The April 1 exploit drained Drift’s Solana vaults; the protocol’s own breakdown puts the haul at $295.7 million, led by $159.3 million in JLP and $71.4 million in USDC.
- Drift opened DFX recovery-token claims on Oct. 1, issuing one token per USDT of verified loss for about 299.5 million tokens against a pool of about 3.1 million USDT.
Competing figures across trackers
The outlets did not report identical numbers. Coincentral put the remaining stash at 81,454 ETH, worth roughly $194 million to $198 million depending on the source; Decrypt calculated $198.58 million at current prices, while Lookonchain’s post cited 81,864 ETH worth about $195 million.
Crypto.news described progress reports from other monitors that were never reconciled. Onchain Lens logged at least 13,400 ETH, around $32 million, entering the mixer and a wallet snapshot showing about $224.59 million in remaining assets. Salus reported 19,600 ETH, about $46.81 million, moved in 196 transactions on Oct. 20, and estimated a wallet ending in 57c1 retained 6,114.15 ETH, near $14.6 million, after its first outgoing transfers. Crypto.news cautioned that these observations were taken at different times and should not be added together, and that the latest balances could not be independently confirmed from the public Arkham tracker.
How the April heist worked
According to Crypto.news, the attackers spent months posing as representatives of a trading firm and built relationships with Drift contributors before obtaining administrative control through transaction approvals from members of the protocol’s Security Council. They used Solana’s durable nonce feature, which keeps pre-signed transactions valid until executed, then approved a fake token called CarbonVote Token as collateral and borrowed out real liquidity.
Drift said the operation ran for six months and that the group deposited $1 million of its own money to build trust. In June the protocol said Mandiant had attributed the attack to UNC6862, a North Korean threat group. Crypto.news separately noted Elliptic’s April assessment linking the theft to North Korean laundering patterns. DefiLlama ranks the exploit third among 2026 crypto hacks, behind Bitget at $387 million and a Liquid Network exploit at $320 million, Coincentral reported.
Why it matters
Tornado Cash pools deposits from many addresses so funds can later be withdrawn from fresh ones, which breaks the public link between sender and receiver. A transfer into the mixer does not by itself establish that coins were sold or recovered.
For Drift creditors the practical question is the recovery pool. Drift’s exchange now runs as Velocity and sends it between 60% and 90% of daily net protocol revenue, while Tether has committed up to 127.5 million USDT toward the relaunch. Crypto.news reported other partners committed up to $20 million and that DFX claims remain open until Jan. 1, 2028.
What to watch
Further deposits from the 71 tracked addresses, or a resumption of withdrawals from Tornado Cash, would show whether the remaining ETH is being laundered. Updates to the DFX pool balance will set the redemption rate available to verified victims.
Disclaimer: This article is for information only and is not investment, financial or trading advice. Cryptocurrency prices are highly volatile. Always do your own research.
Sources: CoinCentral, Decrypt, Crypto.news
