✓ Verified by 3+ outlets ETH
Drift hacker pushes about $109 million in ETH through Tornado Cash in two days
Summary
Wallets linked to the April 1 exploit of Solana-based exchange Drift deposited about 25,700 ETH, worth roughly $61 million, into the Tornado Cash mixer over about two hours on Oct. 20 after two months of inactivity, according to Cointelegraph and crypto.news, both citing on-chain tracker Lookonchain; Cointelegraph reported another 18,800 ETH (about $46 million) followed on Oct. 21, for a two-day total of about $109 million.
The exploiter’s addresses still hold a large balance, but figures differ: Cointelegraph put it at about 81,454 ETH, roughly $194 million, citing Arkham, while crypto.news cited Lookonchain’s estimate of 81,864 ETH, about $195 million, and said the balances had not yet been independently verified through Arkham.
Mixers pool deposits and pay out through separate addresses, which makes stolen funds harder to trace; crypto.news noted that sending ETH to Tornado Cash does not show whether it has been sold, cashed out or recovered.
Drift said in June that a forensic investigation by Mandiant attributed the attack to UNC6862, a North Korean threat group, according to both outlets.
Estimates of the original loss also differ: Cointelegraph said Drift reported about $295 million in losses, while crypto.news cited Chainalysis’ $285 million estimate and said Drift’s later asset breakdown totaled about $295.7 million under different valuations.
Updates
- Update, : Oct. 20: Decrypt, citing Arkham Intelligence, said 25,700 ETH (about $61.56 million) went into Tornado Cash over roughly two hours, and that 71 attacker-linked addresses still hold 81,454 ETH, about $198.58 million. It said the deposits follow a first round on July 23-24 of about 23,095 ETH.
- Update, : Oct. 21: Cointelegraph reports a Drift exploiter-linked wallet sent another 18,800 ETH (about $46 million) to Tornado Cash on Wednesday, bringing the two-day total to 44,510 ETH, or about $109 million, citing Onchain Lens; the wallets still held 56,569 ETH, roughly $138 million, per Arkham data.
Key facts
- Cointelegraph said the Drift exploit ranks as the third-largest crypto hack of 2026, according to DefiLlama.
- Drift opened claims and redemptions for DFX recovery tokens on Oct. 1; the recovery pool held about $3.1 million at launch and receives exchange revenue and any recovered funds, Cointelegraph reported.
- crypto.news said an earlier Onchain Lens update showed at least 13,400 ETH (about $32 million) moving to the mixer, and that security firm Salus counted 19,600 ETH (about $46.81 million) from one wallet in 196 transactions, figures that had not been reconciled.
- According to crypto.news, the April attackers spent months posing as a trading firm, obtained Security Council approvals via Solana’s durable-nonce feature, and used a fake token, CarbonVote Token (CVT), as collateral to withdraw real assets, per Chainalysis.
- Tether has committed up to $127.5 million in support for Drift’s recovery and other partners up to $20 million, and DFX claims stay open until Jan. 1, 2028, crypto.news reported.
- Drift said in June that forensic firm Mandiant attributed the April exploit to UNC6862, a North Korean threat group, Decrypt reported.
- Drift’s DFX recovery token pool held about 3.1 million USDT at launch on Oct. 1, so early redemptions paid roughly a penny on the dollar, according to Decrypt.
- Over Oct. 20-21 the exploiter moved 44,510 ETH (about $109 million) to Tornado Cash, nearly 37% of the $295 million stolen in April, and still held about 56,569 ETH (roughly $138 million), Cointelegraph reported citing Onchain Lens and Arkham.
Related stories
- Indian exchange Unocoin keeps withdrawals frozen after spotting outgoing ether transfers from its BitGo wallets
- Binance sets aside $6.34 billion to cover record hack as TRM and Chainalysis tie it to North Korea's TraderTraitor
- Ethlabs shelves faster Ethereum blocks to push quantum-resistant accounts into 2027, two years ahead of the official roadmap