Drift exploiter resurfaces after 2 months, moves $61.6M in ETH to Tornado Cash

A wallet group linked to the $285 million Drift Protocol exploit has resumed moving stolen cryptocurrency, with blockchain analysts reporting that approximately $61.56 million in Ethereum was deposited into Tornado Cash on October 20.

According to blockchain monitoring account Lookonchain, the suspected exploiter transferred 25,700 ETH into the privacy-focused mixing service over a two-hour period, ending roughly two months of reported inactivity. The tracker estimated that the wallets still controlled 81,864 ETH worth approximately $195 million.

An earlier Onchain Lens update identified at least 13,400 ETH, valued at roughly $32 million, flowing into Tornado Cash. Its accompanying wallet snapshot showed approximately $224.59 million in remaining assets.

Meanwhile, the two trackers reported different amounts as the transfers unfolded. The latest wallet balances have yet to be independently verified through Arkham.

Drift exploiter resumes Tornado Cash transfers

The reported activity represents another stage in the movement of assets taken from Drift, a Solana-based decentralized derivatives platform.

Tornado Cash pools cryptocurrency deposits and allows funds to be withdrawn through separate addresses, making direct transaction tracing more difficult. Sending ETH to the service does not establish whether the funds were converted into cash, sold on an exchange or recovered by another party.

A separate monitoring account reported that one wallet deposited 19,600 ETH, worth approximately $46.81 million, through 196 transactions on October 20. That figure falls between the two social-media observations but has not been reconciled against a complete transaction-level record.

The Drift Protocol exploiter deposited 19,600 ETH (~$46.81M) into Tornado Cash in 196 transactions on October 20, 2026, moving funds held for roughly 202 days, according to the our Tornado monitoring system.

On April 1, the Solana perpetuals platform suffered an estimated $285M… https://t.co/OEjYr8uRzQ pic.twitter.com/sXaSkLDsRe

— Salus (@salus_sec) October 20, 2026

The same account identified a wallet ending in 57c1 that had reportedly held stolen assets since April. It estimated the address retained 6,114.15 ETH, valued near $14.6 million, after its first outgoing transactions.

These wallet-specific figures cannot establish the exploiter’s total remaining assets because investigators track several addresses and the balances change as transfers occur.

April Drift exploit followed months of social engineering

The original attack took place on April 1, when attackers obtained administrative control of Drift through transaction approvals from members of its Security Council.

In an April 9 investigation, Chainalysis estimated losses at $285 million, representing more than half the protocol’s total value locked.

The attackers reportedly spent months posing as representatives of a trading firm and building relationships with Drift contributors. They exploited Solana’s durable nonce feature, which permits pre-signed transactions to remain valid until execution.

After obtaining sufficient multisignature approvals, the attackers took control of administrative permissions and approved a fake token called CarbonVote Token, or CVT, as collateral.

According to Chainalysis, the attackers manufactured trading activity around CVT to create an artificial price history. They then used the token as collateral to withdraw genuine assets, including stablecoins and cryptocurrencies.

Subsequently, Drift published a more detailed asset breakdown totaling approximately $295.7 million in stolen tokens. The figure differs from the initial forensic estimate because the reports use different valuations and accounting scopes.

Investigators traced portions of the proceeds moving between Solana and Ethereum, where the attacker accumulated ETH before the latest reported mixing activity.

Investigators linked the attack to North Korean operators

Security researchers have connected the Drift theft to a suspected North Korean hacking operation.

In an April 7 assessment, blockchain analytics company Elliptic identified transaction patterns and laundering techniques consistent with earlier North Korea-linked attacks.

Drift later reported that an investigation by cybersecurity firm Mandiant had attributed the incident to UNC6862, a North Korean threat group.

The platform had previously linked the attack to the operators behind Radiant Capital’s October 2024 exploit. Radiant suffered losses estimated at approximately $50 million in that incident.

The case was part of a series of major DeFi thefts in April. As crypto.news previously reported, April exploit losses exceeded $600 million during the month’s first 18 days, including separate attacks on Drift and KelpDAO.

Drift recovery claims opened in October

While investigators continued tracing the stolen cryptocurrency, Drift established a program to compensate affected users.

On October 1, the project opened claims and redemptions for DFX recovery tokens. Its announcement stated that each verified USDT of loss entitled an affected user to one DFX token.

The protocol fixed the total token supply at approximately 299.5 million and said its recovery pool contained around 3.1 million USDT at launch.

Users can redeem DFX against available pool funds, trade the tokens or retain them while additional funds accumulate. The redemption amount depends on the pool balance and outstanding token supply, so holding a DFX token does not guarantee immediate repayment at face value.

The project said proceeds from its relaunched trading platform, Velocity, would contribute to the recovery pool. Tether has separately committed up to $127.5 million in support, while other partners have committed up to $20 million.

Drift’s October announcement states that funds recovered through enforcement action, freezing or other recovery efforts will be added to the pool. DFX claims remain open until January 1, 2028.