Drift Hacker Launders $61 Million in ETH Through Tornado Cash, Holds $194 Million
A wallet linked to the $295 million Drift Protocol hack transferred approximately $61 million in Ethereum to Tornado Cash on October 20, 2026. The movement ended nearly two months of inactivity and raised fresh concerns about the laundering of stolen cryptocurrency.
Blockchain tracking data indicates that the attacker still controls approximately 81,454 ETH, valued at $194 million. The latest transfers highlight the challenges investigators face when tracking funds stolen from decentralized finance platforms.
Drift Exploiter Transfers 25,700 ETH to Tornado Cash
Blockchain monitoring identified roughly 25,700 ETH moving into Tornado Cash within two hours on Tuesday. The transactions involved wallets associated with the April attack on Drift Protocol, a decentralized derivatives exchange operating on Solana.
Tornado Cash allows users to obscure transaction histories by combining cryptocurrency deposits from multiple addresses. Although blockchain transactions remain publicly visible, the service makes connecting deposits with subsequent withdrawals significantly harder.
The latest activity follows an earlier movement of approximately 23,100 ETH through Tornado Cash in July. Despite these transfers, wallets associated with the attacker continue holding substantial cryptocurrency reserves.
North Korean Group Linked to $295 Million Drift Hack
The security breach occurred on April 1, 2026, when attackers compromised Drift Protocol and drained approximately $295.4 million in user assets. Investigators subsequently examined suspicious transactions, compromised administrative permissions, and the movement of stolen funds across blockchain networks.
A forensic investigation conducted by cybersecurity firm Mandiant attributed the attack to UNC6862, a North Korean threat group. The findings strengthened concerns about sophisticated cybercriminal operations targeting decentralized finance infrastructure.
The attackers reportedly spent months developing relationships with protocol contributors before executing the exploit. Their operation demonstrated how social engineering and compromised administrative controls can undermine cryptocurrency platforms without exploiting traditional smart contract vulnerabilities.
Drift Recovery Efforts Continue as Stolen Funds Move
Drift Protocol introduced its DFX recovery token program on October 1 to help compensate users affected by the attack. Eligible users can claim tokens representing their losses and redeem them against available recovery funds.
The recovery pool initially contained approximately $3.1 million. Additional funding may come from platform revenue, recovered assets, and other contributions.
However, the latest Ethereum transfers complicate efforts to trace and recover the remaining stolen funds. Investigators must continue monitoring associated wallets as the attacker moves assets through privacy-focused services.
The incident underscores persistent security risks across decentralized finance. It also highlights the importance of stronger administrative safeguards, transaction monitoring, and coordinated asset recovery efforts.
