TLDR
- A wallet tied to the Drift Protocol hack sent 25,700 Ether, worth about $61 million, to Tornado Cash on Tuesday.
- The addresses had been quiet for about two months before the two-hour burst.
- The exploiter’s wallets still hold about 81,454 Ether, worth roughly $194 million to $198 million.
- The April 1 hack caused about $295 million in losses and was linked to a North Korean group.
- Drift’s DFX recovery token paid early redemptions of about a penny on the dollar.
A wallet tied to the Drift Protocol hack sent about $61 million in Ether to Tornado Cash on Tuesday. The addresses had been quiet for about two months.
The wallet deposited 25,700 Ether into the mixer over roughly two hours, according to Lookonchain. Arkham Intelligence data shows the same pattern.
The Drift Protocol exploiter, who stole over $270M, is moving $ETH to #TornadoCash after 2 months of inactivity.
Over the past 2 hours, the exploiter has deposited 25,700 $ETH ($61.56M) into #TornadoCash and still holds 81,864 $ETH ($195M).https://t.co/FRtFrS7rew pic.twitter.com/9ISUIlkHvT
— Lookonchain (@lookonchain) October 20, 2026
The deposits came in batches of 100 Ether, worth about $237,800 each, plus smaller 10 Ether chunks. Those sizes match the mixer’s fixed deposit pools.
What the Transfers Show
Crypto mixers pool funds from many addresses and make trails harder to trace. Users can later withdraw from fresh addresses.
Arkham tracks 71 addresses linked to the attacker. They still hold 81,454 Ether, worth roughly $194 million to $198 million depending on the source.
The wallets also hold about $561,600 in other coins, including USDT, USDC, Solana and USDY.
Tuesday’s move follows an earlier round on July 23 and 24. An address labeled Drift Exploiter 4 sent about 23,095 Ethereum, then worth around $44.4 million, to the same mixer.
Background on the Drift Hack
The April 1 exploit hit Drift’s vaults on Solana and caused about $295 million in losses. The attacker gained admin powers, introduced a fake token and borrowed real liquidity.
Drift’s breakdown shows $159.3 million in JLP and $71.4 million in USDC. Most of the USDC was later swapped and bridged to Ethereum.
Drift said the attack was a six-month operation. The group posed as a quantitative trading firm and deposited $1 million of its own money to build trust.
In June, Drift said Mandiant attributed the attack to UNC6862, a North Korean threat group.
DefiLlama ranks the exploit as the third-largest crypto hack of 2026. The Bitget hack reached $387 million and the Liquid Network exploit reached $320 million.
Drift’s relaunched exchange now runs as Velocity. It opened claims for its DFX recovery token on Oct. 1.
The token was issued at one per USDT of verified loss, about 299.5 million in total. The recovery pool held about $3.1 million at launch.
Early redemptions paid roughly 0.0104 USDT per token, about a penny on the dollar. The pool receives 60% to 90% of Velocity’s daily net protocol revenue.
Tether has committed up to 127.5 million USDT toward the relaunch and recovery. Any stolen funds recovered through freezes, the bounty or law enforcement also go into the pool.
Arkham’s entity page still shows 81,454 Ether in the exploiter’s wallets after Tuesday’s deposits.
Stop guessing and start investing with confidence. KnockoutStocks gives you the AI insights, market intelligence, and stock research you need to spot opportunities, cut through the noise, and make smarter investment decisions — all in one powerful platform.
Sign up today and get 50% OFF full access to our premium stock picks.
Simply use coupon code SPECIAL50 at checkout to claim your exclusive discount.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
