Drift Exploiter Mixes $61.5 Million in Ethereum After Two-Month Silence
Exploiter wallets move millions into mixer after quiet period
Wallets connected to the April 1 Drift Protocol exploit deposited 25,700 Ethereum, worth approximately $61.56 million, into the privacy mixer Tornado Cash over roughly two hours on Tuesday.
The addresses had not moved funds for about two months before the latest burst of activity.
Tornado Cash is a mixer — a service that pools cryptocurrency from multiple users and returns it from fresh addresses, making it harder to trace the original sender on the blockchain.
What the data shows
- 25,700 ETH (about $61.56 million) was deposited into Tornado Cash in batches matching the mixer's fixed pool sizes: mostly 100 ETH chunks and smaller 10 ETH amounts.
- Arkham Intelligence tracks 71 addresses linked to the attacker. After Tuesday's deposits, these wallets still hold 81,454 ETH, worth roughly $198.58 million.
- The wallets also hold about $561,600 in other assets including USDT, USDC, Solana, and USDY.
- A single Fartcoin token remains in the holdings, valued at about 15 cents — far less than the $4.1 million in Fartcoin Drift said was stolen in April.
Official source: Drift's recovery efforts
Drift, which has relaunched its exchange as Velocity, opened claims for its DFX recovery token on October 1. The company issues one DFX token for every verified USDT of loss, totaling about 299.5 million tokens.
The recovery pool held approximately 3.1 million USDT at launch. Early redemptions therefore paid out roughly 0.0104 USDT per token, or about one cent on the dollar.
The pool receives between 60% and 90% of Velocity's net protocol revenue daily, scaling up as revenue grows. Tether has committed up to 127.5 million USDT toward the relaunch and recovery. Any stolen funds recovered through freezes, bounties, or law enforcement will also flow into the pool.
Other sources: Attack background
The April 1 exploit hit Drift's vaults on Solana after the attacker gained admin powers, introduced a fake token, and used it to borrow out real liquidity. Drift's asset breakdown puts the total theft at $295.7 million, led by $159.3 million in JLP (Jupiter Liquidity Provider tokens) and $71.4 million in USDC.
In April, Drift said the attack was a six-month operation in which the group posed as a quantitative trading firm, met contributors in person, and deposited $1 million of its own money to build trust. In June, forensic firm Mandiant attributed the attack to UNC6862, a North Korean threat group.
Tuesday's deposits follow a first round on July 23 and 24, when an address labeled "Drift Exploiter 4" sent about 23,095 ETH, then worth roughly $44.4 million, into the same mixer.
What remains unclear
It is not confirmed how much of the original stolen funds have been laundered through Tornado Cash across all deposit rounds. The discrepancy between the $4.1 million in Fartcoin Drift reported as stolen and the single token worth 15 cents still visible in Arkham's tracking suggests some assets may have already been moved or sold outside tracked addresses.
Why this matters for the Drift community
As Drift victims begin recovering losses through the DFX token system, the continued movement of stolen funds raises questions about whether recovered assets could eventually feed back into the recovery pool. The pool's long-term viability depends on both Velocity's revenue and the success of law enforcement efforts against the group behind the exploit.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.
Related Posts
OpenAI asks Congress whether an AI development slowdown would be legal
Hunter Biden‑linked meme coin LAPTOP aims at TRUMP token holders
