Drift Exploiter Moves $61M in ETH Through Tornado Cash

A wallet linked to the Drift Protocol hack moved roughly $61 million in Ether through Tornado Cash on Tuesday, breaking a two-month silence. Blockchain analytics platform Lookonchain first flagged the activity in a post on X.

The wallet deposited 25,700 ETH to the mixer over a two-hour window, according to Lookonchain's on-chain data. The exploiter's remaining addresses still held approximately 81,454 ETH, worth about $194 million, as tracked by Arkham Intelligence.

Tornado Cash pools funds from multiple addresses and severs the link between sender and recipient. That structure complicates tracing by analytics firms and law enforcement, and it marks a shift from the exploiter's static holdings of the past two months.

How large was the Drift hack?

Drift, a Solana-based decentralized exchange, reported approximately $295 million in losses from the April 1 exploit. In June, the protocol said a forensic investigation by cybersecurity firm Mandiant attributed the attack to UNC6862, a North Korean threat group.

The incident ranks as the third-largest crypto hack of 2026, according to DefiLlama. Two exploits exceeded it: the $387 million Bitget hack and the $320 million Liquid Network exploit.

What recovery options do users have?

Drift opened claims and redemptions for DFX recovery tokens on Oct. 1. The tokens give affected users a claim on a recovery pool, which held about $3.1 million at launch.

The pool receives ongoing exchange revenue plus any funds recovered from the exploit. At $3.1 million against $295 million in losses, the pool covered roughly 1% of the damage at launch, leaving recovered assets and revenue flow as the main variables for claimants.

What does the laundering attempt signal?

The timing matters for investigators. After two months of inactivity, the exploiter chose a coordinated series of deposits rather than a single transfer — 25,700 ETH across two hours. On-chain analysts will now watch whether the remaining 81,454 ETH follows the same route through Tornado Cash or moves to other infrastructure.

The attribution to UNC6862 places the case within a broader pattern of North Korean-linked crypto theft, which Mandiant tracks as a persistent revenue stream for the regime. Mixers remain the primary laundering tool for such groups despite sanctions on Tornado Cash, and tracing efforts typically depend on downstream withdrawal points where funds re-enter regulated venues.

For Drift users holding DFX tokens, any frozen or recovered portion of the exploited funds would flow into the recovery pool. The $61 million now cycling through Tornado Cash represents the first test of whether investigators can intercept a meaningful share before it dissolves into wider circulation.

The exploiter still controls roughly $194 million in ETH. Each subsequent movement through mixing infrastructure narrows the window in which exchanges, issuers and law enforcement can act on traceable funds.