✓ Verified by 2+ outlets ETH
Drift hacker sends about $61 million in ETH to Tornado Cash after two months of silence
Summary
Wallets linked to the April 1 exploit of Solana-based exchange Drift deposited about 25,700 ETH, worth roughly $61 million, into the Tornado Cash mixer over about two hours on Oct. 20 after two months of inactivity, according to Cointelegraph and crypto.news, both citing on-chain tracker Lookonchain.
The exploiter’s addresses still hold a large balance, but figures differ: Cointelegraph put it at about 81,454 ETH, roughly $194 million, citing Arkham, while crypto.news cited Lookonchain’s estimate of 81,864 ETH, about $195 million, and said the balances had not yet been independently verified through Arkham.
Mixers pool deposits and pay out through separate addresses, which makes stolen funds harder to trace; crypto.news noted that sending ETH to Tornado Cash does not show whether it has been sold, cashed out or recovered.
Drift said in June that a forensic investigation by Mandiant attributed the attack to UNC6862, a North Korean threat group, according to both outlets.
Estimates of the original loss also differ: Cointelegraph said Drift reported about $295 million in losses, while crypto.news cited Chainalysis’ $285 million estimate and said Drift’s later asset breakdown totaled about $295.7 million under different valuations.
Key facts
- Cointelegraph said the Drift exploit ranks as the third-largest crypto hack of 2026, according to DefiLlama.
- Drift opened claims and redemptions for DFX recovery tokens on Oct. 1; the recovery pool held about $3.1 million at launch and receives exchange revenue and any recovered funds, Cointelegraph reported.
- crypto.news said an earlier Onchain Lens update showed at least 13,400 ETH (about $32 million) moving to the mixer, and that security firm Salus counted 19,600 ETH (about $46.81 million) from one wallet in 196 transactions, figures that had not been reconciled.
- According to crypto.news, the April attackers spent months posing as a trading firm, obtained Security Council approvals via Solana’s durable-nonce feature, and used a fake token, CarbonVote Token (CVT), as collateral to withdraw real assets, per Chainalysis.
- Tether has committed up to $127.5 million in support for Drift’s recovery and other partners up to $20 million, and DFX claims stay open until Jan. 1, 2028, crypto.news reported.