Drift-Linked Wallets Send $61M in ETH to Tornado Cash

Wallets tied to the Drift hack deposited 25,700 ETH, valued at approximately $61 million, into Tornado Cash on Oct. 20, marking the first activity from these addresses in two months. According to observations from Lookonchain cited by Cointelegraph, the transfers took place over a two-hour window while users of the Drift Protocol awaited payouts from a recovery-token program.

Earlier on Tuesday, The Defiant reported the transfer total at $54.8 million. By 12:38 UTC, Cointelegraph adjusted the figure to approximately $61 million. This renewed movement complicates asset tracing for a recovery initiative that remains well below the total losses incurred in April.

Drift Hack: Linked Wallets Resume Tornado Cash Deposits

How Much ETH Moved on Oct. 20?

Lookonchain tracked 25,700 ETH entering the privacy mixer during a two-hour span, as reported by Cointelegraph. Prior to this, transfers from wallets associated with the alleged exploiter had remained dormant for weeks.

Related: Drift $280M Hack Linked to DPRK After Six-Month Setup

The destination of the funds is as critical as the volume transferred. Tornado Cash aggregates assets from multiple addresses to obscure transaction trails, complicating efforts by investigators to trace the proceeds of the exploit once they enter the service.

How Were the Transfers Broken Up?

Blockchain trackers also detected activity from an address identified as Drift Exploiter 5. U.Today reported that this wallet moved 13,400 ETH over the preceding day, citing blockchain-monitoring data.

The outlet noted that the deposits were distributed in consistent tranches of 100 ETH, referencing Onchain Lens, Lookonchain, and a broader estimate from MistTrack covering related wallets. Rather than emptying the entire balance at once, the sender repeatedly utilized the same increment.

Drift, the Labeled Wallets and the UNC6862 Attribution

Which Exchange Suffered the Original Attack?

Drift is a decentralized exchange built on Solana. Cointelegraph reported that the platform estimated its losses from the April 1 attack at approximately $295 million. The October transactions involve Ether held in wallets tied directly to that breach, several months after the initial incident.

Numerous monitoring platforms have kept watch over these holdings. The Defiant cited five Etherscan-labeled exploiter wallets, while Cointelegraph referenced Arkham for the remaining assets and Lookonchain for the fresh deposits. These designations tie the monitored wallets back to the Drift case.

Who Attributed the Attack to a North Korean Group?

According to Cointelegraph, Drift disclosed in June that a forensic investigation by cybersecurity firm Mandiant attributed the April attack to UNC6862, a North Korean threat group.

While that attribution applies to the original breach, the October transfer data stems from blockchain analytics services tracking related addresses; the reporting does not independently identify the individuals operating those wallets.

From the April Exploit to October Recovery Claims

What Happened Before the Wallets Reactivated?

The case has progressed through several distinct phases, including the April 1 exploit, Drift’s June disclosure of Mandiant’s findings, and prior mixer activity in July. U.Today estimated the July movement at roughly $44 million.

Both Cointelegraph and U.Today noted that the latest deposits follow a two-month period of inactivity. They coincide with an active compensation effort launched by Drift for affected users, placing the movement of allegedly stolen funds alongside ongoing restitution measures.

When Did Drift Open Its Recovery Program?

Drift initiated claims and redemptions for DFX recovery tokens on Oct. 1. These tokens provide impacted users with a claim against a recovery pool, which held approximately $3.1 million at the time of the program’s launch.

Recovery distributions rely entirely on the accumulation of assets within that pool. Because its designated funding sources are exchange revenue and recovered funds, both the ongoing business operations of Drift and the tracking of stolen capital are vital for users awaiting compensation.

Why the Tornado Cash Transfers Matter for Drift Users

How Do the Deposits Complicate Recovery?

For users awaiting reimbursement, the immediate impact is a more obscured fund trail. Assets connected to the exploit are flowing into a service designed to sever the link between deposits and subsequent withdrawals, even as the recovery pool relies heavily on recovering those exact funds.

Investigators must now navigate the mixing process to locate capital that could potentially replenish the pool. While Cointelegraph highlights the increased difficulty of tracking, it does not characterize the deposits as the end of Drift’s recovery efforts.

How Large Was Drift’s Attack Among 2026 Hacks?

Citing DefiLlama, Cointelegraph ranked the Drift breach as the third-largest cryptocurrency hack of 2026. The larger incidents identified were the $387 million Bitget hack and the $320 million Liquid Network exploit.

With losses estimated around $295 million, Drift’s compensation initiative is among the largest of the year. The October activity is significant primarily as a development in a major theft investigation and user recovery program rather than as a market driver for Ethereum.

The Figures: Remaining ETH and the Recovery Funding Gap

How Much ETH Remained in Linked Wallets?

According to Arkham data cited by Cointelegraph, addresses linked to the alleged exploiter still hold roughly 81,454 ETH, valued at approximately $194 million. A substantial portion of the stolen funds remains outside the mixer.

This remaining balance ensures that future wallet movements will remain relevant to recovery tracking. Both investigators and affected users are closely monitoring where these assets will travel next, alongside the funds already routed through the mixer.

How Large Was the Recovery Pool Compared With Losses?

The roughly $3.1 million available in the pool at its Oct. 1 launch represented approximately 1% of the estimated $295 million loss. Both figures are drawn from Cointelegraph’s coverage of the recovery program and the April attack.

This discrepancy illustrates the primary funding challenge facing the program. Whether further payouts can be supported depends on additional capital reaching the pool via the outlined revenue and recovery streams, rather than the initial launch balance.

Drift Recovery Risks and Tornado Cash’s Legal Context

What Is the Main Risk for Affected Users?

Because the recovery pool launched far below reported losses and a massive quantity of ETH remains in exploit-linked wallets, additional transactions through Tornado Cash make tracing and recovering those assets significantly more difficult.

The recovery process also depends on operational success: exchange revenue serves as a primary funding pillar. Consequently, future payouts rely not only on locating stolen crypto assets but also on channeling ongoing revenues into the compensation framework.

What Changed in Tornado Cash’s Sanctions Status?

According to Decrypt, the U.S. Treasury removed Tornado Cash from its sanctions list on March 21, 2025, overturning its previous 2022 designation. The decision followed legal challenges regarding the Treasury’s authority to sanction smart contracts associated with the service.

Upon announcing the removal, the Treasury emphasized that it retains ongoing concerns regarding money laundering, specifically pointing to North Korean actors. This regulatory backdrop is particularly relevant given Drift’s attribution of the original exploit to a North Korean threat group via Mandiant’s findings.

What Happens Next for Drift’s Recovery Pool?

Which Parts of the Recovery Process Are Already Open?

The DFX claims and redemption mechanism has been operational since Oct. 1. Affected users can pursue claims against the recovery pool, while blockchain monitoring services continue to track assets tied to the exploit.

The October deposits have diverted part of the tracking effort toward Tornado Cash. Meanwhile, the ETH still resting in associated addresses remains a distinct target for ongoing surveillance.

What Can Increase the Money Available for Payments?

Drift’s official channels for increasing pool reserves are exchange revenue and successfully recovered funds. Contributions from either avenue would bolster the resources backing DFX recovery claims.

Inflows to the pool and milestones in asset recovery are the critical metrics for impacted users moving forward. The renewed mixer activity highlights the complexity of these efforts, while the remaining balances in linked wallets keep fund tracing at the core of the investigation.

FAQ

Which Wallet Did Trackers Label Drift Exploiter 5?

U.Today used this label for an address linked by trackers to the Drift exploit. The outlet attributed 13,400 ETH in transfers to Tornado Cash over the preceding day to that specific wallet.

How Much Did U.Today Report Moving Through Tornado Cash in July?

U.Today estimated the prior movement at approximately $44 million, describing the July activity as an earlier phase of mixer usage before wallets resumed transfers in October.

When Did Drift Disclose Mandiant’s Attribution of the Attack?

According to Cointelegraph, Drift disclosed the finding in June, stating that Mandiant’s forensic investigation attributed the April 1 attack to the North Korean threat group UNC6862.

What Claim Do DFX Recovery Tokens Give Affected Users?

DFX tokens represent a direct claim on Drift’s recovery pool. Claims and redemptions opened on Oct. 1, at which point the pool held roughly $3.1 million.

What Funding Sources Replenish Drift’s Recovery Pool?

As reported by Cointelegraph, the pool is funded by exchange revenue and any successfully recovered funds, tying the compensation initiative to both the platform’s business performance and ongoing asset recovery investigations.

Where Did DefiLlama Rank the Drift Exploit Among 2026 Crypto Hacks?

Cointelegraph cited DefiLlama in ranking the exploit third for the year. The two larger incidents referenced were the Bitget hack at $387 million and the Liquid Network exploit at $320 million.

This article is for information only and is not financial advice.