Drift exploiter moves $109M in Ether to Tornado Cash in two days
Drift hacker moves $109 million in Ether to a mixer
A wallet linked to the April hack of the decentralized exchange Drift sent 18,800 Ether, worth about $46 million, to Tornado Cash on Wednesday, according to Cointelegraph.
The same exploiter-linked wallet sent $61 million in Ether to the mixer on Tuesday. That brought the two-day total to 44,510 ETH, or about $109 million, according to the blockchain data tracker Onchain Lens, as cited by Cointelegraph.
Tornado Cash is a crypto mixer: a service that pools and moves coins to make them harder to trace. The article says these transfers make the funds harder to track.
Key numbers from the transfers
- 18,800 ETH, about $46 million, moved to Tornado Cash on Wednesday.
- $61 million in Ether moved to the mixer on Tuesday.
- Two-day total: 44,510 ETH, or $109 million.
- The moved funds equal nearly 37% of the $295 million stolen from Drift in April.
- Drift exploiter-labelled wallets still held 56,569 Ether, worth roughly $138 million, after Wednesday's transfers, according to Arkham data.
What Drift and its consultants said about the hack
The Solana-based DEX Drift reported losses of about $295 million from the April 1 hack. Solana is a blockchain network, and a DEX is a trading platform that runs without a central operator.
Drift's security consultant Mandiant attributed the attack to a North Korean threat group, according to the report. DefiLlama ranks the attack as this year's third-largest crypto hack.
Recovery claims opened for affected users
Drift opened claims and redemptions for DFX recovery tokens on Oct. 1. The tokens give affected users a claim on a pool that started with about $3.1 million and receives exchange revenue and recovered funds, according to the report.
What is confirmed
The transfers described by Onchain Lens and Arkham data are reported figures. Drift's loss of about $295 million from the April 1 hack is the exchange's own reported figure, and the ranking as the year's third-largest hack comes from DefiLlama.
The attribution to a North Korean threat group is Mandiant's assessment, not an independently confirmed fact in this report.
What is still unclear
The article does not say who controls the wallet or where the remaining Ether is being sent, and it does not explain what will happen to the funds already moved through the mixer.
Why it matters
Funds sent through a mixer are harder for investigators and exchanges to trace, which can complicate efforts to recover stolen assets. The report says the transfers so far account for nearly 37% of the total stolen amount, while a large share of the Ether remains in the labelled wallets.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.