Drift Exploiter Moves $61.6M in ETH to Tornado Cash After Two Months Dormant

Published October 20, 2026, 06:45 PM PKT. Based on onchain reports from Lookonchain, Onchain Lens and Salus on October 20, 2026 (primary sources) and reporting from crypto.news, Cointelegraph and blockchain.news the same day (secondary sources).

A wallet group linked to the $285 million Drift Protocol exploit has resumed moving stolen cryptocurrency, with onchain analysts reporting that approximately $61.6 million in Ethereum was deposited into Tornado Cash on October 20, ending roughly two months of reported inactivity. According to blockchain monitoring account Lookonchain, the suspected exploiter transferred 25,700 ETH, worth approximately $61.56 million, into the privacy-focused mixing service over a two-hour period, crypto.news reported. The tracker estimated the wallets still controlled 81,864 ETH, worth approximately $195 million, after the transfers.

The 25,700 ETH transfer to Tornado Cash

Tornado Cash pools cryptocurrency deposits and allows funds to be withdrawn through separate addresses, making direct transaction tracing more difficult, crypto.news explained. Sending ETH to the service does not establish whether the funds were converted into cash, sold on an exchange or recovered by another party. The October 20 movement is a new stage in the laundering arc of the April 1 attack: @EmberCN reported that the hacker had already converted the stolen assets into 131,564 ETH at an average price of $2,154 back in April and previously laundered 24,400 ETH in July, according to blockchain.news.

Trackers disagree on the tally

The headline figure comes with a caveat. An earlier Onchain Lens update identified at least 13,400 ETH, valued at roughly $32 million, flowing into the mixer, with its accompanying wallet snapshot showing approximately $224.59 million in remaining assets, crypto.news reported. A separate monitoring account, Salus's tornado monitoring system, reported that one wallet deposited 19,600 ETH, worth approximately $46.81 million, through 196 transactions on October 20, moving funds held for roughly 202 days. The same account identified a wallet ending in 57c1 that had reportedly held stolen assets since April and estimated the address retained 6,114.15 ETH, valued near $14.6 million, after its first outgoing transactions. Cointelegraph, citing Arkham, put the remaining exploiter balance at about 81,454 Ether, worth roughly $194 million. crypto.news cautioned that the different figures reflect observations published at different times and should not be combined into a single transfer total, and that the latest balances had not been independently verified through Arkham.

The April 1 heist behind the coins

The funds trace back to the April 1 attack on Drift, a Solana-based decentralized derivatives platform. In an April 9 investigation, Chainalysis estimated losses at $285 million, representing more than half the protocol's total value locked, crypto.news reported. Drift later published a more detailed asset breakdown totaling approximately $295.7 million in stolen tokens, with the figures differing because the reports use different valuations and accounting scopes. Investigators traced portions of the proceeds moving between Solana and Ethereum, where the attacker accumulated ETH before the latest reported mixing activity.

The attack was not a smart contract exploit. The attackers reportedly spent months posing as representatives of a trading firm and building relationships with Drift contributors, then exploited Solana's durable nonce feature, which permits pre-signed transactions to remain valid until execution. After obtaining sufficient multisignature approvals from members of Drift's Security Council, the attackers took control of administrative permissions and approved a fake token called CarbonVote Token, or CVT, as collateral. According to Chainalysis, the attackers manufactured trading activity around CVT to create an artificial price history, then used the token as collateral to withdraw genuine assets, including stablecoins and cryptocurrencies. The case was part of a series of major DeFi thefts in April; April exploit losses exceeded $600 million during the month's first 18 days, including separate attacks on Drift and KelpDAO, crypto.news reported.

The North Korea attribution

Security researchers connected the Drift theft to a suspected North Korean hacking operation. In an April 7 assessment, blockchain analytics company Elliptic identified transaction patterns and laundering techniques consistent with earlier North Korea-linked attacks, crypto.news reported. Drift later reported that an investigation by cybersecurity firm Mandiant had attributed the incident to UNC6862, a North Korean threat group. The platform had previously linked the attack to the operators behind Radiant Capital's October 2024 exploit, in which Radiant suffered losses estimated at approximately $50 million. The Drift exploit ranks as the third-largest crypto hack of 2026, according to DefiLlama, cited by Cointelegraph, behind the $387 million Bitget hack and the $320 million Liquid Network exploit.

The DFX recovery pool and its 2028 deadline

While investigators keep tracing the stolen cryptocurrency, Drift set up a program to compensate affected users. On October 1, the project opened claims and redemptions for DFX recovery tokens, with each verified USDT of loss entitling an affected user to one DFX token, crypto.news reported. The protocol fixed the total token supply at approximately 299.5 million and said its recovery pool contained around $3.1 million USDT at launch. Users can redeem DFX against available pool funds, trade the tokens or retain them while additional funds accumulate, though holding a DFX token does not guarantee immediate repayment at face value. The project said proceeds from its relaunched trading platform, Velocity, would contribute to the recovery pool, that Tether has separately committed up to $127.5 million in support, and that other partners have committed up to $20 million. Drift's October announcement states that funds recovered through enforcement action, freezing or other recovery efforts will be added to the pool, and DFX claims remain open until January 1, 2028.

This article is news reporting and is not investment advice.

Sources

• Lookonchain, X post, October 20, 2026, primary source: suspected exploiter deposited 25,700 ETH (~$61.56 million) into Tornado Cash over a two-hour period after roughly two months of inactivity; wallets still controlled 81,864 ETH (~$195 million) (as reported by crypto.news and Cointelegraph)
• Salus (@salus_sec) tornado monitoring system, X post, October 20, 2026, primary source: one wallet deposited 19,600 ETH (~$46.81 million) through 196 transactions on October 20, moving funds held for roughly 202 days; wallet ending in 57c1 held stolen assets since April and retained 6,114.15 ETH (~$14.6 million) after its first outgoing transactions (as reported by crypto.news)
• Onchain Lens, X update, October 20, 2026, primary source: at least 13,400 ETH (~$32 million) flowing into Tornado Cash; wallet snapshot showed approximately $224.59 million in remaining assets (as reported by crypto.news)
• Drift Protocol, October 2026 announcement, primary source: DFX recovery-token claims and redemptions opened October 1, 2026; one DFX per verified USDT of loss; total supply approximately 299.5 million; recovery pool held about $3.1 million USDT at launch; Tether committed up to $127.5 million in support; claims remain open until January 1, 2028 (as reported by crypto.news)
• crypto.news, October 20, 2026 (Olivia Stephanie), secondary source: tracker tallies and caveats on combining figures, Chainalysis $285 million loss estimate, Drift's $295.7 million asset breakdown, durable-nonce method, CarbonVote Token collateral scheme, April's $600 million exploit wave, DFX pool terms
• Cointelegraph, October 20, 2026, secondary source: Lookonchain figures, Arkham estimate of 81,454 ETH (~$194 million) remaining, Mandiant attribution to North Korea's UNC6862 group, DefiLlama third-largest-hack-of-2026 ranking
• blockchain.news / @EmberCN, October 20, 2026, secondary source: hacker converted stolen assets into 131,564 ETH at a $2,154 average price in April; previously laundered 24,400 ETH in July
• Chainalysis, April 9, 2026 investigation, secondary source: $285 million loss estimate representing more than half the protocol's total value locked
• Elliptic, April 7, 2026 assessment, secondary source: transaction patterns and laundering techniques consistent with earlier North Korea-linked attacks