Wallets linked to the Drift Protocol hack resumed laundering stolen Ethereum on October 20, 2026, after roughly two months of inactivity. Onchain Lens initially tracked 13,400 ETH, worth about $32 million, entering Tornado Cash; a later Lookonchain update put deposits across the exploiter’s wallets at 25,700 ETH, valued at approximately $61.56 million.
Key takeaways
- Lookonchain tracked 25,700 ETH entering Tornado Cash over two hours.
- The Drift Protocol attack took $285 million on April 1, 2026.
- Lookonchain estimated that attacker wallets still held 81,864 ETH.
- Drift’s Tether-supported buyback fund covers about 1% of users’ net losses.
Stolen Ethereum laundering resumes through Tornado Cash
The October 20 transfers mark the second major laundering attempt involving assets from Drift. In July, the attackers moved about $44 million through the same mixer.
Onchain Lens and Lookonchain tracked the reactivated wallets, with monitoring also drawing on Arkham data. The initial 13,400 ETH movement came from an attacker-controlled address labeled Drift Exploiter 5. Lookonchain’s subsequent update captured a larger total over a two-hour period.
Separate monitoring by Salus identified 19,600 ETH, worth approximately $46.81 million, deposited through 196 transactions on October 20.
The attackers sent funds in batches of exactly 100 ETH. Tornado Cash pools deposits and enables withdrawals through separate addresses, obscuring direct connections between senders and recipients and making transaction tracing harder.
The mixer deposits do not, by themselves, establish that the stolen Ethereum was sold on an exchange or converted into cash.
Six months of planning culminated in a $285 million theft
On April 1, 2026, $285 million vanished in just 12 minutes from Drift Protocol, a decentralized derivatives platform built on Solana. Both TRM Labs and Chainalysis pointed to UNC4736, a North Korean state-backed group also called Citrine Sleet, as the party responsible.
Over a six-month span, the scheme was carefully built up. Posing as a legitimate venture fund, the attackers attended international conferences to connect with developers and even deposited $1 million of their own funds into the platform’s pools to appear trustworthy.
Afterward, they took advantage of weaknesses in Cursor and VSCode to breach the devices of Drift’s Security Council members, gaining access to administrative keys. A counterfeit CarbonVote token became the final piece of the puzzle, allowing the attackers to pass it off as collateral while draining the platform’s actual reserves.
According to Drift, a forensic review carried out afterward linked the attack to a group tied to North Korea.
Remaining balances and Drift’s recovery program
Most of the stolen Ethereum remained under attacker control despite the laundering activity. Lookonchain’s October 20 update estimated a remaining balance of 81,864 ETH, worth approximately $195 million.
Earlier estimates placed the holdings between 82,000 and 94,000 ETH, valued at up to $224 million. The later wallet reading followed the additional mixer deposits.
Authorities froze approximately $9.2 million in stolen assets in August. Transfers through Tornado Cash complicate tracing, but the deposits alone do not establish the final destination or recovery status of the funds.
Drift opened DFX recovery-token claims and redemptions on October 1, 2026. The compensation program includes a buyback fund supported by Tether, and the team expects to add future platform revenue to it.
The fund currently covers about 1% of users’ net losses.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.