Drift-Linked Wallets Send $61M in ETH to Tornado Cash

Wallets associated with the Drift hack transferred 25,700 ETH—valued at roughly $61 million—into Tornado Cash on October 20, marking the first activity from these addresses in two months. Lookonchain data cited by Cointelegraph shows the funds were deposited during a two-hour period, occurring while users of the Drift Protocol awaited payouts through a recovery-token program.

Earlier on Tuesday, The Defiant reported the transferred amount at $54.8 million. By 12:38 UTC, Cointelegraph revised the figure to approximately $61 million. This renewed activity complicates asset tracking for a recovery initiative that remains well below the total funds lost in April.

Drift Hack: Linked Wallets Resume Tornado Cash Deposits

How Much ETH Moved on Oct. 20?

According to Cointelegraph, Lookonchain recorded 25,700 ETH moving into the mixer over a span of two hours, ending weeks of dormancy for wallets tied to the suspected exploiter.

Related: Drift $280M Hack Linked to DPRK After Six-Month Setup

The destination of the funds is as significant as the volume. Tornado Cash aggregates cryptocurrency from various sources to obscure transaction histories, making it significantly harder for investigators to trace the proceeds once they enter the protocol.

How Were the Transfers Broken Up?

Blockchain monitors also detected transactions originating from an address identified as Drift Exploiter 5. Drawing on blockchain monitoring tools, U.Today reported that this specific wallet transferred 13,400 ETH throughout the previous day.

According to the outlet—which cited Onchain Lens, Lookonchain, and a wider estimate from MistTrack covering related addresses—the deposits were executed in repeated 100 ETH tranches rather than draining the wallet’s total balance in a single transaction.

Drift, the Labeled Wallets and the UNC6862 Attribution

Which Exchange Suffered the Original Attack?

Drift operates as a decentralized exchange on Solana. Cointelegraph reported that the platform estimated its losses from the April 1 breach at approximately $295 million. The October transactions involve Ether held in wallets connected to that security incident, months after the initial theft.

A variety of monitoring platforms have kept tabs on these balances. The Defiant pointed to five exploiter wallets labeled via Etherscan, whereas Cointelegraph referenced Arkham for the remaining funds and Lookonchain for the fresh deposits. These specific designations tie the monitored wallets directly to the Drift incident.

Who Attributed the Attack to a North Korean Group?

In June, Drift announced that a forensic review conducted by cybersecurity firm Mandiant linked the April breach to UNC6862, a threat group operating out of North Korea, as noted by Cointelegraph.

While that attribution applies to the original exploit, the October transactions were identified by blockchain analytics firms tracking the associated addresses. News reports do not independently confirm the identities of the individuals controlling these wallets.

From the April Exploit to October Recovery Claims

What Happened Before the Wallets Reactivated?

The timeline of the incident spans several key milestones: the initial exploit on April 1, Drift’s June announcement regarding Mandiant’s attribution, and prior mixer transactions in July. U.Today estimated the July transfers at roughly $44 million.

Both Cointelegraph and U.Today noted that the most recent transfers follow a two-month hiatus. They also coincide with Drift launching a recovery initiative for impacted users, running parallel to an active compensation scheme.

<

When Did Drift Open Its Recovery Program?

Drift launched claims and redemptions for DFX recovery tokens on October 1. These tokens grant impacted users a claim against a recovery pool that contained roughly $3.1 million at the time of its rollout.

Payouts depend entirely on the ongoing accumulation of capital within the pool. Because its stated funding relies on exchange revenue and successful asset recovery efforts, both the exchange’s commercial performance and the pursuit of stolen funds are critical for users awaiting compensation.

Why the Tornado Cash Transfers Matter for Drift Users

How Do the Deposits Complicate Recovery?

For individuals seeking compensation, the immediate effect is a more obscure trail of funds. Stolen assets are flowing into a protocol designed to sever the connection between deposits and withdrawals, while the recovery pool itself relies heavily on recovering lost capital.

Investigators must now navigate the mixing process to track down funds that might otherwise replenish the pool. While Cointelegraph highlights the increased difficulty in tracking, it does not suggest these deposits spell the end of Drift’s recovery efforts.

How Large Was Drift’s Attack Among 2026 Hacks?

Citing DefiLlama, Cointelegraph placed the Drift breach as the third-largest cryptocurrency exploit of 2026. The larger security incidents cited were the $387 million Bitget hack and the $320 million Liquid Network breach.

With losses estimated near $295 million, Drift’s compensation initiative ranks among the largest for the year. The October asset movements are significant primarily as a development in a high-profile theft investigation and user reimbursement process rather than a market driver for Ethereum’s price.

The Figures: Remaining ETH and the Recovery Funding Gap

How Much ETH Remained in Linked Wallets?

According to Cointelegraph’s citation of Arkham, approximately 81,454 ETH—valued at about $194 million—remains sitting in addresses linked to the alleged exploiter, meaning a substantial sum has yet to enter the mixer.

This remaining reserve ensures that future wallet activity will remain vital for recovery tracking. Both investigators and affected users are closely monitoring where these remaining assets are directed, alongside the funds already pushed through the mixer.

How Large Was the Recovery Pool Compared With Losses?

The roughly $3.1 million available in the recovery pool at its October 1 rollout accounts for about 1% of the estimated $295 million in total losses. Both figures originate from Cointelegraph’s coverage of the April incident and the subsequent recovery program.

This metric highlights the core funding deficit facing the project. Whether future payouts can scale will depend on additional capital flowing into the pool through established revenue streams and asset recovery initiatives, rather than the initial pool balance.

Drift Recovery Risks and Tornado Cash’s Legal Context

What Is the Main Risk for Affected Users?

The recovery pool debuted far below the scale of reported losses, and a significant amount of ETH remains in wallets tied to the exploit. Continued transactions via Tornado Cash make it increasingly difficult to trace those holdings and secure assets for the pool.

Additionally, the recovery plan depends on operational performance, with exchange revenue designated as a primary funding stream. Consequently, future payouts rely not just on locating stolen crypto, but also on funneling operational earnings into the reimbursement framework.

<

What Changed in Tornado Cash’s Sanctions Status?

According to Decrypt, the U.S. Treasury Department removed Tornado Cash from its sanctions list on March 21, 2025, rolling back its 2022 designation following legal challenges regarding the Treasury’s jurisdiction over the platform’s smart contracts.

When lifting the sanctions, the Treasury noted that it maintains ongoing apprehensions regarding illicit finance, specifically involving North Korea. That regulatory backdrop remains relevant to a case where Drift—backed by Mandiant’s forensic findings—attributed the initial exploit to a North Korean threat group.

What Happens Next for Drift’s Recovery Pool?

Which Parts of the Recovery Process Are Already Open?

The DFX claim and redemption mechanism has been operational since October 1, providing affected users a pathway to claim a share of the recovery pool while blockchain analytics firms continue monitoring associated accounts.

The October mixing transactions represent a new hurdle for investigators, while the remaining ETH held in linked addresses constitutes a separate monitoring target outside of funds already slated for the recovery program.

What Can Increase the Money Available for Payments?

Drift has outlined exchange revenue and successfully recovered assets as the primary drivers to increase the capital supporting DFX recovery claims.

For impacted users, future payouts hinge entirely on new funds entering the pool and successful recovery milestones. The latest mixer activity underscores the difficulty of this mission, while substantial holdings remaining in un-mixed wallets keep fund tracing at the heart of the ongoing investigation.

?FAQ

01Which Wallet Did Trackers Label Drift Exploiter 5?

U.Today applied this designation to an address identified by blockchain trackers as being connected to the Drift exploit. The publication linked this specific address to 13,400 ETH transferred to Tornado Cash throughout the preceding day.

02How Much Did U.Today Report Moving Through Tornado Cash in July?

U.Today estimated the previous asset movement at roughly $44 million, characterizing the July activity as an earlier utilization of the mixer prior to the resumption of wallet transfers in October.

03When Did Drift Disclose Mandiant’s Attribution of the Attack?

According to Cointelegraph, Drift made the findings public in June, revealing that Mandiant’s forensic investigation had tied the April 1 breach to UNC6862, a North Korean threat group.

04What Claim Do DFX Recovery Tokens Give Affected Users?

DFX tokens provide holders with a direct claim against Drift’s recovery pool. Claims and redemptions opened on October 1, at which point the pool held roughly $3.1 million.

<

05What Funding Sources Replenish Drift’s Recovery Pool?

As reported by Cointelegraph, the pool is backed by exchange revenue and recovered funds. These two mechanisms tie the recovery initiative directly to both the platform’s operational output and the successful tracking of assets linked to the hack.

<

06Where Did DefiLlama Rank the Drift Exploit Among 2026 Crypto Hacks?

Citing DefiLlama, Cointelegraph positioned the attack as the third-largest for the year, trailing the Bitget hack at $387 million and the Liquid Network exploit at $320 million.

This article is for information only and is not financial advice.