Drift Exploiter Sends Another $46M in ETH to Tornado Cash, Two-Day Total Hits $109M

Published October 21, 2026, 5:30 PM PKT. Based on blockchain tracker Onchain Lens on October 21, 2026 (primary source), with reporting from Crypto Briefing and Crypto.news on October 21, 2026, PANews reporting on PeckShield monitoring, Drift Protocol's June 3, 2026 recovery update, and MABOnChain's October 20, 2026 report on the first tranche (secondary sources).

Wallets linked to the April 2026 exploit of Drift Protocol sent about 18,800 ETH, worth roughly $46 million, into the Tornado Cash mixer on October 21, 2026, according to blockchain tracker Onchain Lens, taking the total moved over two days to 44,510 ETH, worth about $109 million. The second tranche is a major new development in a laundering operation that had been quiet for about two months: MABOnChain reported on October 20 that the same linked wallets had sent about 25,700 ETH, worth roughly $61 million, into Tornado Cash in about two hours on Tuesday, ending a dormant stretch that began after the April theft.

The $46 million second tranche

Onchain Lens published the two-day breakdown on October 21, putting the October 20 tranche at 25,710 ETH, worth about $63.04 million, and the October 21 tranche at 18,800 ETH, worth about $46.11 million, for a combined 44,510 ETH worth about $109.15 million. The small differences from the figures in MABOnChain's October 20 report, which cited Lookonchain's estimate of 25,700 ETH worth about $61.56 million for the first tranche, reflect how trackers value the same transfers at different times and at different Ether prices, not a disagreement about whether the transfers happened. Crypto Briefing's October 21 report gave the same two-day shape: a first batch of 25,710 ETH valued at between $61 million and $63 million, followed the next day by a second batch worth $46 million.

PeckShield monitoring, reported by PANews on October 21, independently flagged the new batch of about 18,800 ETH moving into Tornado Cash, giving the second tranche a second tracker source. Crypto.news, reporting the Onchain Lens figures on October 21, stressed that its $109 million total covers the complete two-day period cited by Onchain Lens, and that interim totals published by different monitoring accounts while the transfers were still under way were lower. Readers should treat every dollar figure in this story as an estimate tied to Ether's price around the time of each deposit, because the underlying unit that moved is ETH, and its dollar value moves with the market.

The $138 million still held

After the latest deposits, wallets labeled by Arkham Intelligence as belonging to the Drift exploiter still held about 56,569 ETH, worth roughly $138 million, according to Crypto.news and Crypto Briefing reporting on October 21. That remaining balance is the reason this story is not finished: even after $109 million in two days, the tracked wallets still control a sum close to half the original theft. Crypto Briefing put it plainly in its October 21 report, noting that after the second tranche, the cleanup operation is far from finished.

Tracker snapshots of exploiter holdings differ because different firms label different sets of wallets, so the figures should not be added or subtracted across firms as if they were one bank balance. What is consistent across the October 21 reporting is the direction of travel: a large, previously dormant stockpile is now being fed into a mixer in large tranches, day after day, after months of inactivity. Trackers had already counted roughly $44 million moved through Tornado Cash from the same incident earlier in 2026, before this week's two-day burst, according to the October 21 reports.

The $295 million April theft

Drift Protocol is a decentralized exchange for perpetual futures that runs on Solana, and its April 1, 2026 exploit cost about $295 million, according to Crypto Briefing, which ranks it as the third largest theft of 2026. Crypto.news put the platform's later accounting at about $295.7 million, with early estimates differing because investigators valued the affected tokens at different points. Most of the stolen assets did not stay on Solana: the bulk was converted or bridged into ETH on Ethereum, which is why the laundering is now running through an Ethereum-based mixer, according to Crypto Briefing.

Drift said in its June 3, 2026 recovery update that cybersecurity firm Mandiant attributed the attack to UNC6862, a North Korean threat group, according to Crypto.news. Crypto Briefing's October 21 report described the attribution as pointing, with medium to high confidence, toward a group linked to North Korean state actors, tracked under the designations UNC4736 and UNC6862. The attackers had spent months developing relationships with Drift contributors before acquiring the approvals needed to move assets, according to accounts published after the exploit, and investigators described a compromise of operational access and transaction authorization, not simply an error in a trading smart contract.

What a mixer deposit does not prove

A deposit into Tornado Cash does not, by itself, prove that stolen assets have been exchanged for cash or recovered by authorities, according to Crypto.news. Tornado Cash accepts deposits into privacy pools that make it harder to follow funds once they are withdrawn to new addresses, and attribution of the deposits rests on addresses identified as belonging to the attacker. No new recoveries tied to the latest laundering activity have been reported, according to Crypto Briefing.

That distinction matters for victims watching the numbers climb. Each new tranche reduces the amount sitting in labeled wallets, but it does not automatically increase the amount available to claimants, because funds inside a mixer are harder to freeze or seize than funds sitting in a known address. The practical question for recovery is whether any of the mixed funds resurface at exchanges or other choke points where they can be frozen, and so far the October 21 reporting contains no such recovery tied to this week's transfers.

Victims, DFX claims and the $3.1 million pool

Drift opened claims and redemptions on October 1, 2026 for DFX, a Solana token allocated to affected users according to their verified losses, according to Crypto.news. The recovery framework assigns one DFX for each USDT of recognized loss and fixes total supply at 299,500,810.998 tokens. At launch, the recovery pool contained around $3.1 million in USDT, and the stated initial redemption rate was about 0.0104 USDT per DFX, equivalent to roughly one cent for each dollar of eligible losses. Claiming a token is separate from receiving its full face amount in cash.

Under Drift's published recovery rules, a holder can redeem DFX for an available share of the pool, sell the token on a secondary market, or retain it as additional funding accumulates, and tokens redeemed against the pool are burned, reducing the outstanding supply. A portion of the relaunched platform's net protocol revenue is directed to the pool each day, at 60% on the first 30,000 USDT of daily net revenue, 70% on the next band through 100,000 USDT, and 90% above that threshold, according to Crypto.news. Drift says any assets recovered through freezes, law enforcement, or other recovery measures will be deposited in the pool, and Tether has committed up to $127.5 million in support, while other partners have committed up to $20 million. Those commitments should not be confused with money already available for immediate redemption. Eligible users must submit their DFX claims before 00:00 UTC on January 1, 2028, and any tokens still unclaimed at that deadline will be permanently burned, according to Crypto.news.

Measured against a $295 million loss, a $3.1 million starting pool is small, and the new $109 million in mixer deposits underlines the gap between what victims have been allocated and what the exploiter still controls. The next development to watch is not another tranche, which now looks like a pattern, but any sign that mixed funds have been frozen, seized, or returned to the pool, or any new statement from Drift about the claims process. Until then, the story is a slow-motion laundering operation, counted in public, tranche by tranche, while victims hold tokens worth about a cent on the dollar at the initial redemption rate.

This article is news reporting and is not investment advice.

Sources

• Onchain Lens, Drift exploiter transfers 44,510 ETH to Tornado Cash over October 20 and 21, 2026 (October 21, 2026), primary source, as reported by Crypto.news
• Crypto.news, Drift exploiter sends $109M to Tornado Cash, retains $138M in ETH (October 21, 2026), secondary source
• Crypto Briefing, Drift exploiter moves $109M in Ether to Tornado Cash in two days (October 21, 2026), secondary source
• PANews, Drift attacker transfers a new batch of 18,800 ETH to Tornado Cash (October 21, 2026, PeckShield monitoring), secondary source
• Drift Protocol, June 3, 2026 recovery update: Mandiant attribution to UNC6862 and DFX recovery framework, secondary source
• MABOnChain, Drift Exploiter Moves $61.6M in ETH to Tornado Cash After Two Months Dormant (October 20, 2026), secondary source, background on the first tranche