Drift Exploiter Sends $109M in Ether to Tornado Cash in Two Days

Wallets linked to the April hack of decentralized exchange Drift sent 44,510 ETH, worth about $109 million, to Tornado Cash on Oct. 20 and 21, according to blockchain tracker Onchain Lens. Arkham-labelled exploiter wallets still held 56,569 ETH, roughly $138 million, after the latest deposits.

The two days of transfers equal nearly 37% of the $295 million taken from Drift in April. DefiLlama ranks the attack as this year's third-largest crypto hack.

How the $109M Moved Over Two Days

The burst started on Tuesday. The addresses had been quiet for about two months, then pushed about 25,700 ETH, worth roughly $61.6 million, into the mixer over about two hours.

On Wednesday, an exploiter-linked wallet sent another 18,800 ETH, about $46 million, to Tornado Cash.

Arkham transfer data shows the deposits landing in batches of 100 ETH, about $237,800 each, plus smaller 10 ETH chunks. Those amounts match the mixer's fixed pool sizes.

A mixer deposit does not, by itself, show that the stolen ETH has been cashed out or recovered. It shows the funds have entered a pool where the public trail gets harder to follow.

A Second Round After July's $44M

This is not the first time Drift's stolen funds have gone into Tornado Cash. On July 23 and 24, an address labelled Drift Exploiter 4 sent about 23,095 ETH, then worth around $44.4 million, into the same mixer.

Adding the two rounds, about 67,600 ETH has now moved into Tornado Cash, worth roughly $153 million at the prices on each transfer day.

The 56,569 ETH still sitting in labelled wallets is close in size to everything mixed so far.

What Drift Lost and Who It Blames

The April 1 attacker gained admin powers over the protocol and used a fake token to borrow real liquidity. Drift's own asset breakdown puts the loss at $295.7 million, led by:

• $159.3 million in JLP, the Jupiter Liquidity Provider token
• $71.4 million in USDC

Most of that haul was later swapped and bridged to Ethereum, which is why the funds now move as ETH.

In a June 3 recovery update, Drift said forensic firm Mandiant "conclusively attributed the attack to UNC6862," a North Korean threat group.

Recovery Pool Pays About a Penny per Dollar

Victims are being compensated through DFX recovery tokens, with claims opened on Oct. 1. About 299.5 million tokens exist.

The recovery pool held about 3.1 million USDT at launch. Early redemptions therefore paid roughly 0.0104 USDT per token, about a penny on the dollar.

The pool is designed to grow. It receives a daily cut of 60% to 90% of Velocity's net protocol revenue, with the share rising as daily revenue grows. Tether has committed up to 127.5 million USDT toward the relaunch and recovery.

The gap between the 3.1 million USDT in the pool at launch and the $138 million in ETH still held by the exploiter shows how much of the loss stays out of reach. The next figure to watch is that 56,569 ETH balance: any further deposits from those wallets would show up on the same trackers that flagged this week's moves.