An address linked to the $295 million Drift Protocol heist in April deposited 25,700 Ether (ETH) into the Tornado Cash mixing service on Tuesday. The transfer continued a laundering process that investigators have traced to a North Korean state-sponsored organization and could further complicate recovery efforts for thousands of Drift users who have yet to be paid.

Two hours of transfers in 100 ETH tranches

The deposits were made over approximately two hours and totaled about $61.56 million at the time of the transfer, according to data from Arkham Intelligence. The wallet had remained dormant for roughly two months before the sudden activity.

Arkham’s transfer logs show deposits in fixed amounts of 100 ETH, worth about $237,800 each, along with smaller 10 ETH transactions. The 100 ETH transfers correspond to Tornado Cash deposit pools. The service allows users to withdraw funds later from a different address, obscuring the connection between the sender and receiver. That decoupling of deposit and withdrawal is what makes the mixer such a persistent obstacle for tracing and freezing efforts.

Chainalysis has also mapped the movement of the funds. In an X post published Tuesday, the company said that on April 1, the exploiter transferred funds from the five wallets used in the attack to a single stopover wallet across 13 separate transactions. That wallet then remained inactive until the funds began moving into Tornado Cash in 100 ETH tranches.

The transfer was not the first effort to move the stolen assets through the mixer. An address identified as Drift Exploiter 4 sent 23,095 ETH, worth approximately $44.4 million at the time, to Tornado Cash on July 23 and 24.

Assets remaining in exploiter wallets

Following Tuesday deposits, Arkham continued to track 81,454 ETH valued at approximately $194 million, according to TFTC. The hacker’s 71 identified addresses held about $198.58 million in total. Arkham’s portfolio view also showed approximately $561,600 in USDT, USDC, Solana, and USDY, as well as one Fartcoin worth roughly 15 cents. The size of that residual balance is the key variable for recovery: funds still in traceable wallets remain exposed to freezes and clawbacks, while anything entering the mixer becomes far harder to reach.

The on-chain analytics account Lookonchain reported the transfer on X:

The Drift Protocol exploiter, who stole over $270M, is moving $ETH to #TornadoCash after 2 months of inactivity. Over the past 2 hours, the exploiter has deposited 25,700 $ETH ($61.56M) into #TornadoCash and still holds 81,864 $ETH ($195M). — Lookonchain (@lookonchain) October 20, 2026

The exploit originally targeted a Solana-based protocol, but the attacker later used bridge technology to convert the assets into ETH. According to Drift’s asset distribution table, the attacker took tokens valued at $295.7 million, including $159.3 million in JLP, the Jupiter Liquidity Provider Token, and $71.4 million in USDC. That cross-chain hop forced investigators to follow the proceeds across two separate ledgers, lengthening the trail well before the mixer entered the picture.

Social engineering preceded the attack

Drift’s post-mortem at drift.trade said the April 1 attack did not exploit a vulnerability in the protocol’s code. Instead, it relied on social engineering conducted over a six-month period.

TFTC, citing the same post-mortem, reported that the attackers posed as a trading company and deposited $1 million in real funds to build credibility. They also met Drift contributors in person at conferences. The attackers subsequently used a code-execution vulnerability in developer tooling alongside a fake wallet application to drain the protocol in less than 12 minutes. The episode underscores that security in decentralized finance extends beyond on-chain code to the people and tooling surrounding a protocol.

In a June 3 post about its recovery efforts, Drift said a Mandiant forensic investigation identified UNC6862, a North Korean threat actor, as responsible for the attack. Drift cited Mandiant as saying there were “direct ties to other state-sponsored actors involved in similar attacks on other platforms.”

Recovery pool remains small relative to losses

Drift opened claims for DFX tokens on October 1. The recovery pool held $3.1 million at the time and was expected to increase through exchange profits and clawbacks. Against the $295 million in reported losses, early claimants were eligible to recover about one cent for every dollar lost.

Law enforcement has frozen approximately $9.2 million, according to TFTC, equivalent to nearly three cents for every dollar lost. With about $194 million still controlled by the exploiter and an increasing share transferred into Tornado Cash, the recovery outlook remains limited. The U.S. Office of Foreign Assets Control blacklisted Tornado Cash in 2022, but there has been no confirmation that any deposit made by a DPRK-linked entity has been clawed back. What happens next will be visible in three places: the pace of further Tornado Cash deposits from the remaining wallets, any new freezes or clawbacks, and growth in the DFX recovery pool.

The Drift exploit is the third-largest cryptocurrency hack recorded in 2026, according to the DeFiLlama crypto exploits tracker. It ranks behind the $387.5 million Bitget exploit and the $320 million Liquid Network exploit.

Original report: https://www.cryptopolitan.com/drift-hack-recovery-61-5m-tornado-cash/