A wallet connected to the $295 million Drift Protocol hack moved roughly $61 million in Ethereum to Tornado Cash on October 20, 2026, ending nearly two months of dormancy and renewing concerns over the laundering of stolen cryptocurrency.

Blockchain tracking data shows the attacker still controls approximately 81,454 ETH, valued at about $194 million. The latest movement underscores the difficulty investigators face in tracing funds stolen from decentralized finance (DeFi) platforms.

25,700 ETH Sent to Tornado Cash in Two Hours

On-chain monitoring detected approximately 25,700 ETH flowing into Tornado Cash within a two-hour window on Tuesday. The transactions involved wallets tied to the April attack on Drift Protocol, a decentralized derivatives exchange built on Solana.

Tornado Cash obscures transaction histories by pooling cryptocurrency deposits from multiple addresses. While blockchain transactions remain publicly visible, the service makes it significantly harder to connect deposits with subsequent withdrawals. The mixer has long sat at the center of regulatory and criminal proceedings: the U.S. Treasury Department sanctioned it in 2022, though those sanctions were lifted in March 2025 after a federal appeals court found the designation had exceeded the agency's authority. U.S. and United Nations investigators have repeatedly identified the service as a favored laundering channel for hackers linked to North Korea.

Tuesday's activity follows an earlier movement of roughly 23,100 ETH through the mixer in July. Even after both transfers, wallets associated with the attacker continue to hold substantial cryptocurrency reserves. Extended dormancy followed by staged transfers is a pattern analysts have frequently observed in high-value exploits, where stolen funds sit idle before being pushed to mixers in batches.

Mandiant Links Hack to North Korean Group

The breach occurred on April 1, 2026, when attackers compromised Drift Protocol and drained approximately $295.4 million in user assets. Investigators subsequently examined suspicious transactions, compromised administrative permissions, and the movement of stolen funds across blockchain networks.

A forensic investigation by cybersecurity firm Mandiant attributed the attack to UNC6862, a North Korean threat group, as previously reported by CoinDesk. The findings reinforced concerns about sophisticated cybercriminal operations targeting DeFi infrastructure. Mandiant assigns "UNC" labels to activity clusters it has not yet formally named, and the attribution fits a broader pattern: North Korean-linked groups have been implicated in cryptocurrency thefts totaling billions of dollars in recent years, proceeds that United Nations researchers say help fund the country's weapons programs.

The attackers reportedly spent months cultivating relationships with protocol contributors before executing the exploit. The operation demonstrated how social engineering and compromised administrative controls can undermine cryptocurrency platforms without exploiting conventional smart contract vulnerabilities.

Recovery Program Proceeds Amid Fund Movements

Drift Protocol launched its DFX recovery token program on October 1 to compensate users affected by the attack. Eligible users can claim tokens representing their losses and redeem them against available recovery funds.

The recovery pool initially held approximately $3.1 million, with additional funding possible from platform revenue, recovered assets, and other contributions — a fraction of the roughly $295.4 million lost in the breach, underscoring how rarely victims of major crypto exploits are made whole in full.

The latest Ethereum transfers, however, complicate efforts to trace and recover the remaining stolen funds, requiring investigators to keep monitoring the associated wallets as the attacker moves assets through privacy-focused services, with on-chain watchers tracking whether further batches of the remaining reserves surface at the mixer.

The incident underscores persistent security risks across decentralized finance and highlights the need for stronger administrative safeguards, transaction monitoring, and coordinated asset recovery efforts.

Source: CryptoMeter io