Drift exploiter moves $61M in ETH to Tornado Cash, still holds $194M
In brief
- Drift hack-linked wallet deposited 25,700 ETH into Tornado Cash, according to Lookonchain.
- Exploiter addresses still held about 81,454 ETH, roughly $194 million, Arkham data showed.
- Drift reported about $295 million in losses from the April 1 exploit.
- Mandiant attributed the attack to North Korean group UNC6862, according to Drift.
Two months quiet, then the mixer
The deposits went out over roughly two hours on Tuesday. Before that, the wallet had sat idle for two months, according to Lookonchain (as reported by Cointelegraph).
Tornado Cash is a service that obscures transaction trails. Crypto mixers pool funds from multiple addresses and hide where those funds came from, which makes tracing much harder for anyone following the money on the blockchain.
The $61 million is only part of it.
Arkham data showed the exploiter's addresses held about 81,454 ETH, worth roughly $194 million. The on-chain data doesn't show what happens to that balance next, and we won't guess.
The April 1 exploit
Drift is a Solana-based decentralized exchange. It reported about $295 million in losses from the April 1 hack, which DefiLlama ranks as the third-largest crypto hack of 2026. Cointelegraph's report also cited other notable 2026 exploits, including the $387 million Bitget hack and the $320 million Liquid Network exploit.
In June, Drift said a forensic investigation by cybersecurity firm Mandiant attributed the attack to UNC6862, a North Korean threat group. That attribution comes from Drift's statement citing Mandiant's work.
Recovery tokens for affected users
Drift opened claims and redemptions for DFX recovery tokens on Oct. 1. The tokens give affected users a claim on a recovery pool that held about $3.1 million at launch, and it's set up to receive exchange revenue plus any recovered funds.
That's a long way from the $295 million Drift says it lost. Any of the stolen funds that do get recovered would go into that pool, which means the ETH still sitting in the exploiter's addresses matters directly to the users holding DFX.
Frequently asked questions
What did the Drift exploiter send to Tornado Cash?
A wallet linked to the Drift Protocol hack deposited 25,700 ETH (about $61 million) to Tornado Cash over two hours on Tuesday, according to Lookonchain. The wallet had been inactive for two months before the transfers.
Who did Drift say was behind the April 1 hack?
Drift said in June that a forensic investigation by cybersecurity firm Mandiant attributed the attack to UNC6862, a North Korean threat group. Drift, a Solana-based decentralized exchange, reported about $295 million in losses from the hack.
How do Drift's DFX recovery tokens work?
Drift opened claims and redemptions for DFX recovery tokens on Oct. 1. The tokens give affected users a claim on a recovery pool that held about $3.1 million at launch and receives exchange revenue and any recovered funds.
