Drift Protocol Exploiter Moves $61 Million in Ether to Tornado Cash
Key Takeaways
- •A wallet linked to the Drift Protocol hack deposited 25,700 ETH, worth about $61 million, into Tornado Cash over a two-hour window on Tuesday following roughly two months of inactivity.
- •Arkham data shows the exploiter's addresses still hold approximately 81,454 ETH, valued at about $194 million, with Tuesday's deposits representing roughly a quarter of those known holdings.
- •The April 1 attack on Drift resulted in about $295 million in losses, and Mandiant's forensic investigation attributed it to UNC6862, a North Korean threat group.
- •Drift opened claims and redemptions for DFX recovery tokens on Oct. 1, giving affected users claims on a pool that held about $3.1 million at launch and grows through exchange revenue and recovered exploit funds.
- •DefiLlama ranks the Drift exploit as the third-largest cryptocurrency hack of 2026, behind the $387 million Bitget hack and the $320 million Liquid Network exploit.
A wallet linked to the hack of Solana-based decentralized exchange Drift Protocol sent approximately $61 million in Ether (ETH) to Tornado Cash, a cryptocurrency service that obscures transaction trails, according to on-chain data.
Blockchain analytics platform Lookonchain said in an X post that the wallet deposited 25,700 ETH into the cryptocurrency mixer over a two-hour window on Tuesday, following roughly two months of inactivity. Data from Arkham shows the exploiter's addresses still hold about 81,454 ETH, valued at approximately $194 million, with Tuesday's deposits accounting for roughly a quarter of the exploiter's known ETH holdings.
Crypto mixers pool funds from multiple addresses and obscure fund trails, making it harder for investigators to trace the movement of stolen assets. Tornado Cash, an Ethereum-based mixing protocol, was sanctioned by the U.S. Treasury Department's Office of Foreign Assets Control in August 2022, an action that generally prohibits U.S. persons from transacting with the protocol.
April hack caused about $295 million in losses
Drift, a decentralized exchange built on the Solana blockchain, reported about $295 million in losses from the April 1 hack. The company published an incident recovery update on April 16 as it worked to address the fallout. In June, Drift said that a forensic investigation by cybersecurity firm Mandiant attributed the attack to UNC6862, a North Korean threat group. UNC is a preliminary designation Mandiant uses for threat clusters it tracks before formally naming them.
DFX recovery token claims opened Oct. 1
Drift opened claims and redemptions for DFX recovery tokens on Oct. 1. The tokens give affected users a claim on a recovery pool, which held about $3.1 million at launch and receives exchange revenue along with any funds recovered from the exploit. Because that pool grows in part through recovered funds, the tracing difficulty that mixers like Tornado Cash create is directly relevant to affected users' recovery.
Third-largest crypto hack of 2026
According to DefiLlama, the Drift exploit ranks as the third-largest cryptocurrency hack of 2026. Other notable exploits this year include the $387 million Bitget hack and the $320 million Liquid Network exploit.
