Drift Protocol Exploiter Moves $61 Million in Ethereum Through Tornado Cash Mixer

Wallets tied to the massive $295 million exploit of the Drift Protocol in April have reactivated, funneling tens of thousands of Ethereum into the notorious cryptocurrency mixer Tornado Cash. On-chain data indicates that the illicit funds are being actively obscured as the attackers attempt to launder a substantial portion of their multi-million-dollar digital asset haul.

According to transfer data tracked and published by blockchain intelligence firm Arkham Intelligence, wallets linked to the incident pushed 25,700 Ethereum—valued at approximately $61.56 million—into Tornado Cash over a roughly two-hour window on Tuesday. Prior to this sudden burst of activity, the addresses associated with the exploit had remained completely dormant for approximately two months, giving investigators and on-chain analysts a brief respite before the latest movement of capital.

The transactions captured by Arkham’s monitoring systems reveal a deliberate pattern designed to break the public ledger trail linking the sender to the receiver. The deposits hit the mixer in standardized batches consisting primarily of 100 ETH increments, worth roughly $237,800 each, alongside smaller chunks of 10 ETH. These precise amounts correspond directly with Tornado Cash’s fixed deposit pools. By utilizing these fixed pools, users can later withdraw equivalent amounts of cryptocurrency from fresh, untainted addresses, effectively severing the transparent connection between their original wallets and their newly acquired funds.

Despite the substantial outflow on Tuesday, a massive stash of stolen capital remains parked within the attacker’s control. Arkham’s entity tracking page, which monitors a network of 71 distinct addresses linked to the perpetrator, shows that approximately 81,454 ETH still sits within those wallets following Tuesday’s transactions. At current market prices, that remaining Ethereum stash is worth roughly $198.58 million. Beyond their primary Ethereum holdings, the wallets also contain smaller amounts of alternative digital assets, totaling around $561,600 in coins such as USDT, USDC, Solana, and USDY.

Tuesday’s mixing activity follows an earlier round of similar transactions that occurred on July 23 and 24. During that initial phase, an address specifically labeled by analysts as Drift Exploiter 4 transferred approximately 23,095 ETH—which was valued at around $44.4 million at the time—into the exact same privacy-focused mixing protocol.

The ongoing movement of funds stems back to a devastating breach that occurred on April 1. The exploit targeted liquidity vaults on the Solana-based Drift Protocol after the attacker successfully compromised and gained high-level administrative powers. Armed with these administrative privileges, the malicious actor introduced a fraudulent, unauthorized token into the system and used it to borrow and drain out genuine liquidity from the platform.

Comprehensive asset breakdown reports published by Drift place the total haul of the exploit at an estimated $295.7 million. The stolen portfolio was heavily led by $159.3 million in JLP, which is the Jupiter Liquidity Provider token, alongside $71.4 million in USDC. A significant portion of the stolen USDC was subsequently swapped across different networks and bridged over to the Ethereum blockchain, explaining the heavy concentration of ETH currently resting in the attacker’s wallet cluster.

Interestingly, on-chain data also highlights minor discrepancies between official reports and current blockchain ledger states. Arkham’s portfolio overview currently lists precisely one Fartcoin token remaining in the exploiter’s possession, valued at roughly 15 cents. This stands in stark contrast to the $4.1 million worth of Fartcoin that Drift reported as stolen during the initial incident in April, suggesting that portions of the secondary token holdings may have been traded, dumped, or abandoned over the intervening months.

Investigations into the methodology behind the breach have since revealed a remarkably sophisticated and patient threat actor. In the weeks following the attack, Drift disclosed that the incident was the result of a six-month infiltration operation. According to the findings, the hacking group meticulously posed as a legitimate quantitative trading firm, going so far as to meet protocol contributors in person and deposit $1 million of their own capital into the ecosystem over a prolonged period to establish deep trust before executing the exploit.

By June, as forensic investigations deepened, Drift announced that cybersecurity and incident response firm Mandiant had formally attributed the sophisticated attack to UNC6862, a known North Korean state-sponsored threat group notorious for targeting the cryptocurrency industry.

In the wake of the disaster, the protocol underwent a major structural evolution. Drift relaunched its exchange operations under the new banner of "Velocity." As part of its long-term remediation strategy to make affected users whole, the platform officially opened claims for its DFX recovery token on October 1. The recovery mechanism issued one DFX token for every USDT of verified loss, amounting to roughly 299.5 million tokens in total circulation.

At its launch, the dedicated recovery pool held approximately 3.1 million USDT, meaning early redemptions yielded roughly 0.0104 USDT per token, or about a penny on the dollar. However, the structure of the recovery pool is designed to accumulate value over time. It receives a daily cut ranging between 60% and 90% of Velocity’s net protocol revenue, scaling upward as daily transaction volume and revenue grow. Furthermore, stablecoin issuer Tether has committed up to 127.5 million USDT to support the platform’s comprehensive relaunch and user reimbursement efforts. Protocol leadership has also maintained that any stolen funds successfully recovered in the future through asset freezes, bounty programs, or law enforcement actions will be channeled directly back into the recovery pool to boost payouts for affected users.