Drift exploiter moves 25,700 ETH to Tornado Cash after two months idle
The Drift Protocol exploiter sent 25,700 ETH ($61.56M) to Tornado Cash in about two hours on Oct. 20 after two months of inactivity. Roughly 81,864 ETH ($195M) remains, while Drift's recovery pool started at just $3.1M.
Two months quiet, then two hours of deposits. A wallet linked to the Drift Protocol hack pushed 25,700 ETH ($61.56M) into Tornado Cash on Tuesday, Oct. 20. Lookonchain flagged the transfers in a post on X.
The exploiter still holds 81,864 ETH, worth roughly $195M, according to Lookonchain. Arkham data puts the remainder slightly lower, at about 81,454 ETH ($194M). An earlier snapshot counted five Etherscan-labeled Drift exploiter wallets holding about 84,164 ETH.
PeckShield caught it first. At 08:54 UTC, the security firm posted on X that the Drift exploiter address was depositing into Tornado Cash, with about 21.3K ETH (~$50M) sent so far. The deposit was still running at that point.
Tornado Cash is a mixer. It pools funds from multiple addresses and obscures the trail, which makes tracing harder.
The hack behind the funds
Drift, a Solana-based decentralized exchange, was hacked on April 1. Drift reported losses of about $295M. Lookonchain puts the theft at over $270M.
In June, Drift said a Mandiant forensic investigation attributed the attack to UNC6862, a North Korean threat group.
DefiLlama ranks the exploit as the third-largest crypto hack of 2026, behind the $387M Bitget hack and the $320M Liquid Network exploit.
Recovery status
Drift opened claims and redemptions for DFX recovery tokens on Oct. 1. The recovery pool held about $3.1M at launch and receives exchange revenue plus any recovered funds.
Set that against roughly $195M still sitting with the exploiter. The pool is small, and ETH routed through a mixer is harder to trace.
The 25,700 ETH moved is nearly a quarter of the exploiter's combined position, going by Lookonchain's figures. 81,864 ETH has not moved yet.
