Wallets linked to the April 1 exploit of Solana-based decentralized exchange Drift Protocol moved 25,700 ETH—worth approximately $61.56 million—into the crypto mixer Tornado Cash over roughly two hours on Tuesday, according to data from blockchain analytics platform Arkham Intelligence. The flurry of deposits ended a quiet stretch of about two months for the attacker-linked addresses.

Arkham's transfer data shows the Ethereum landing in batches of 100 ETH, worth about $237,800 each, together with smaller chunks of 10 ETH. Those deposit sizes match the mixer's fixed denominational pools, which allow users to withdraw funds later from fresh addresses and break the publicly visible link between sender and receiver. The mixer has been under U.S. Treasury sanctions since August 2022 over its use in laundering proceeds of crypto hacks, though Tuesday's deposits show its pools remain in active use.

Arkham's entity page, which tracks 71 addresses linked to the attacker, still shows 81,454 ETH sitting in those wallets after Tuesday's deposits, worth approximately $198.58 million at current prices. Beyond the Ethereum stash, the wallets hold around $561,600 in other assets, including USDT, USDC, Solana, and USDY.

Tuesday's movement follows an earlier laundering round on July 23 and 24, when an address labeled Drift Exploiter 4 sent approximately 23,095 ETH—then valued at around $44.4 million—into the same mixer. Combined, the two rounds have pushed roughly 48,800 ETH—about $106 million at the valuations when each batch moved—through the mixer, leaving the majority of the tracked Ethereum still sitting in the linked wallets.

The April 1 exploit hit Drift's vaults on Solana after the attacker gained admin powers, introduced a fake token, and used it to borrow out real liquidity. Drift's own asset breakdown puts the total haul at $295.7 million, led by $159.3 million in JLP—the Jupiter Liquidity Provider token—and $71.4 million in USDC, most of which was later swapped and bridged to Ethereum.

Arkham's portfolio view still lists exactly one Fartcoin among the exploiter's holdings, worth about 15 cents—a long way from the $4.1 million in Fartcoin thatift says was taken in April.

Drift said in April that the attack was a six-month operation in which the group posed as a quantitative trading firm, met contributors in person, and deposited $1 million of its own money to build trust. In June, Drift said that forensic firm Mandiant attributed the attack to UNC6862, a North Korean threat group.

Drift, whose relaunched exchange now operates as Velocity, opened claims for its DFX recovery token on Oct. 1, six months to the day after the exploit, issuing one token for every USDT of verified loss—about 299.5 million in total. The recovery pool held roughly 3.1 million USDT at launch, meaning early redemptions paid approximately 0.0104 USDT per token, or about a penny on the dollar.

The pool receives a daily cut of between 60% and 90% of Velocity's net protocol revenue, scaling up as daily revenue grows, and Tether has committed up to 127.5 million USDT toward the relaunch and recovery. Any stolen funds recovered through freezes, the bounty, or law enforcement action also flow into the pool. Recovering funds through tracing, though, means contending with the mixer's core design—severing the visible path between sender and receiver.

Source: Decrypt — Wallet Linked to Drift Exploit Sends $61 Million in Ethereum to Tornado Cash