Drift hacker reportedly moves $61.6 million in ETH into Tornado Cash after two months of silence

The hacker behind April’s Drift Protocol exploit has reportedly sent about 25,700 ETH, roughly $61.6 million, into Tornado Cash, ending about two months of inactivity. Lookonchain flagged the October 20 transfers and says the wallets still hold around 81,864 ETH, worth about $195 million.

Tornado Cash complicates the stolen-funds investigation

Tornado Cash is a cryptocurrency mixing protocol that allows users to deposit assets into a shared pool and withdraw funds through different addresses.

This mechanism can make it more difficult for outside observers to establish a straightforward connection between the original deposit and subsequent withdrawals.

The service’s involvement in the Drift exploit investigation does not, by itself, establish that the ETH has been sold, converted into fiat currency or successfully withdrawn by the attacker.

Instead, the reported deposits indicate that funds linked to the incident have entered a system designed to provide greater transaction privacy.

Additional blockchain monitoring reports have identified different transfer amounts associated with the same broader movement.

Onchain Lens, for example, reported that at least 13,400 ETH, worth approximately $32 million, had moved into Tornado Cash. Another monitoring account, Salus, reported a separate figure of 19,600 ETH, valued at about $46.81 million.

These estimates should not be added together without transaction-level verification. They may reflect different observation times, wallet selections or stages of the same broader movement.

The figures also demonstrate why investors should distinguish between initial alerts from blockchain-monitoring accounts and independently reconciled transaction totals.

The next challenge will be determining whether the funds are moved again, whether receiving wallets interact with centralized exchanges and whether any assets can be frozen or recovered through legal channels.

The Drift exploit therefore remains relevant beyond the initial theft: every new transfer can change the investigative picture without necessarily bringing affected users closer to reimbursement.

How the Drift exploit drained hundreds of millions

The original incident occurred on April 1, 2026, when attackers obtained administrative control over Drift Protocol, a decentralized derivatives trading platform operating on Solana.

Blockchain analytics firm Chainalysis estimated the losses at approximately $285 million in its investigation published on April 9.

The attackers subsequently manipulated administrative permissions and introduced a token known as CarbonVote Token, or CVT, as collateral.

Reported trading activity around the token helped create an artificial impression of market value, allowing the attackers to use it in transactions that released genuine assets from the protocol.

Following the attack, investigators traced portions of the stolen assets across blockchain networks, including movements from Solana to Ethereum.

The subsequent accumulation and transfer of ETH have made Ethereum wallet monitoring an important part of efforts to follow the stolen funds.

Drift later reported that a forensic investigation by cybersecurity firm Mandiant attributed the attack to UNC6862, a North Korean threat group.

Such attribution reflects the investigators’ assessment; the identity of the individuals directly controlling the wallets has not been established publicly in the material cited here.

Drift recovery efforts continue as investors assess the risks

While investigators continue examining wallet activity, Drift has introduced a recovery framework for users affected by the attack.

On October 1, the project opened claims and redemptions for DFX recovery tokens, giving eligible users a mechanism to seek compensation through a dedicated recovery pool.

Under the announced structure, affected users receive one DFX token for each verified USDT of loss. However, a recovery token is not equivalent to an immediate guarantee of repayment at face value.

The amount available for redemption depends on the funds in the pool, the number of outstanding tokens and the terms governing the recovery program.

Drift has also outlined plans to use revenue from its relaunched trading platform, Velocity, to support recovery. Tether has separately committed up to $127.5 million in support, while other partners have announced commitments of up to $20 million.

The latest Drift exploit developments underline the difference between announcing a compensation mechanism and delivering a full recovery.

The outcome will depend on available funding, any assets ultimately recovered and the implementation of the project’s recovery arrangements.

Administrative security, multisignature controls, independent audits, transparent incident reporting and credible recovery plans all matter when deciding how much capital to place on a decentralized platform.

The reported $61.56 million transfer to Tornado Cash does not prove that the stolen funds are permanently beyond reach. Nevertheless, it complicates the tracing process and leaves the recovery of the remaining assets uncertain.

As investigators follow subsequent transactions and Drift works through its compensation arrangements, the central question for affected users remains whether the assets can be recovered and how much of their losses they may ultimately recoup.