Drift exploiter sends $109M to Tornado Cash, retains $138M in ETH

Wallets linked to the April theft from Solana trading platform Drift Protocol have sent an estimated $109 million in Ether to Tornado Cash over two days, renewing scrutiny of funds still controlled by the attacker.

According to blockchain tracker Onchain Lens, the wallets deposited 44,510 ETH into the mixing service on October 20 and 21, including approximately 18,800 ETH valued at $46 million on Wednesday.

DRIFT EXPLOITER MOVES $109M $ETH TO TORNADO CASH

The Drift Protocol exploiter transferred 44.51K $ETH (~$109.15M) to Tornado Cash over the past two days.

· October 20: 25.71K $ETH (~$63.04M)
· October 21: 18.8K $ETH (~$46.11M)

Addresses:… pic.twitter.com/udDVTmEBje

— Onchain Lens (@OnchainLens) October 21, 2026

The October 21 transfers followed roughly 25,710 ETH sent on Tuesday, when blockchain monitors recorded deposits worth approximately $61 million. Combined, the two batches represent more than one-third of the $295 million lost in Drift’s April 1 exploit, based on their estimated dollar values when transferred.

Attribution of the transactions rests on addresses identified as belonging to the attacker. Tornado Cash accepts cryptocurrency deposits into privacy pools, making it harder to follow funds once they are withdrawn to new addresses. A mixer deposit does not, by itself, establish that the stolen assets have been exchanged for cash or recovered by authorities.

The movement comes after a period of relative inactivity. On October 20, Lookonchain reported approximately 25,700 ETH deposited within two hours, while different monitoring accounts published lower interim totals as the transactions were still taking place.

The latest two-day figure covers the complete period cited by Onchain Lens, not the amount observed by each tracker at the same point in time. The reported 44,510 ETH figure and the quoted $109 million are estimates based on the transfer activity and Ether prices around the deposits.

Exploiter wallets retain $138 million after latest transfers

Following Wednesday’s transfers, addresses labeled as the Drift exploiter held approximately 56,569 ETH, valued at $138 million, according to Arkham Intelligence data cited in the October 21 reporting. The figure describes the tracked wallets at that snapshot, not every asset necessarily controlled by the perpetrators.

On Tuesday, the corresponding holdings estimate had been roughly 81,454 ETH, worth $194 million. Those balances changed as funds moved and as Ether’s market price fluctuated.

Past transactions complicate the picture. In August, wallets connected to the same incident had already transferred around $44 million worth of ETH through Tornado Cash, prompting renewed questions about how much could ultimately be frozen or returned to victims.

As crypto.news previously reported, investigators faced difficulties tracking the stolen assets through cryptocurrency mixers.

The April incident was one of the year’s largest decentralized finance thefts. Drift initially faced differing loss estimates because investigators valued affected tokens at different points, while the platform’s later accounting put stolen assets at approximately $295.7 million.

North Korean hackers linked to April Drift exploit

Drift said in its June 3 recovery update that cybersecurity firm Mandiant attributed the attack to UNC6862, a North Korean threat group. Mandiant’s assessment cited operational evidence and similarities with other attacks linked to North Korean operators.

The attackers had spent months developing relationships with Drift contributors before acquiring the approvals needed to move assets, according to accounts published after the exploit. Investigators described a compromise of operational access and transaction authorization, not simply an error in a trading smart contract.

Drift subsequently reorganized its recovery effort around a planned return to trading. In its June update, the platform said it had hired former Helium engineering executive Noah Prince to oversee protocol development and engaged former Gauntlet team members to review risk controls and liquidation infrastructure.

That work formed part of preparations for a relaunched trading platform intended to contribute revenue toward user compensation.

Drift opens DFX recovery claims with initial pool of $3.1 million

On October 1, Drift opened claims and redemptions for DFX, a Solana token allocated to affected users according to their verified losses. The recovery framework assigns one DFX for each USDT of recognized loss and fixes total supply at 299,500,810.998 tokens.

At launch, the recovery pool contained around 3.1 million USDT. The stated initial redemption rate was approximately 0.0104 USDT per DFX, equivalent to roughly one cent for each dollar of eligible losses. Claiming a token is separate from receiving its full face amount in cash.

Under Drift’s published recovery rules, a holder can redeem DFX for an available share of the pool, sell the token on a secondary market or retain it as additional funding accumulates. Tokens redeemed against the pool are burned, reducing the outstanding supply.

A portion of the relaunched platform’s net protocol revenue is directed to the pool each day. Drift lists contributions of 60% on the first 30,000 USDT of daily net revenue, 70% on the next band through 100,000 USDT and 90% above that threshold.

Drift says any assets recovered through freezes, law enforcement or other recovery measures will be deposited in the pool. Tether has committed up to 127.5 million USDT in support, while other partners have committed up to 20 million USDT; those commitments should not be confused with money already available for immediate redemption.

Eligible users must submit their DFX claims before 00:00 UTC on January 1, 2028. Under the recovery terms, any tokens still unclaimed at that deadline will be permanently burned.