North Korean soldier at the Korean Demilitarized Zone

Drift Exploiter Moves $61 Million in Ethereum Through Tornado Cash

By Isaac • October 20, 2026 11:12 pm • Comments

A wallet cluster tied to the April attack on Drift Protocol is moving again, and the destination makes the recovery picture considerably darker.

The wallets deposited 25,700 Ether, worth about $61.56 million at the time, into Tornado Cash over roughly two hours Tuesday, according to an on-chain update summarized by Cointelegraph. The movement ended approximately two months of inactivity and left the tracked addresses holding roughly 81,864 ETH, then valued near $195 million.

The deposits remain visible on Ethereum, but Tornado Cash breaks the simple link between deposits and later withdrawals.

Trending: XRP Ledger Fixes Its Lending Blueprint Before the First Loan Goes Live

Investigators are left relying on timing, transaction patterns, exchange touchpoints and other less direct signals.

The totals differ slightly across analytics providers because they watched different addresses and snapshots while transfers were still underway. Salus counted 19,600 ETH moving through 196 transactions in its own monitoring window.

The variance makes the headline number a time-specific estimate, not evidence that one tracker must be wrong.

The original April 1 attack hit a Solana-based perpetuals platform and produced losses Drift put at roughly $295 million. Its June post-mortem said a forensic investigation by Mandiant attributed the operation to UNC6862, a North Korea-linked threat group that spent months using social engineering and operational access rather than relying on one obvious smart-contract flaw.

Drift’s account describes an attacker who reached people, credentials and internal processes before draining a broad mix of assets. That matters because a contract bug can sometimes be isolated and patched, while a patient intrusion leaves investigators reconstructing months of access across teams, systems, wallets and chains.

The platform later created a recovery bounty with outside partners, secured partial support and built a claims process for users. Even with those measures, the post-mortem made clear that most of the stolen value had already been converted and moved beyond Drift’s direct control.

Drift opened claims and redemptions for DFX recovery tokens on October 1, and crypto.news reported that the launch pool held about $3.1 million. The recovery tokens give affected users a claim on a pool funded by exchange revenue and any stolen assets that can eventually be recovered.

The same report tracked the October wallet activity from an earlier 13,400 ETH estimate through Lookonchain’s later 25,700 ETH total. It also noted that the tracked wallets still controlled about 81,864 ETH after the deposits, so the movement represented only part of the remaining balance.

Drift’s claims process remains open while the latest Tornado Cash deposits make a large wallet recovery harder. Every additional hop through a mixer raises the cost and uncertainty of tracing assets back to a point where they can be frozen or returned.

The blunt takeaway is that nearly $200 million in tracked Ether was still sitting with the exploiter after this transfer. The wallet cluster is active, the laundering path is getting harder to follow, and victims are still depending on a recovery structure that began with only a small fraction of the original loss.

Join the conversation!

We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.

 

Search ProCoinNews