Drift hacker moves $61M in Ether to Tornado Cash, still holds $194M
Hacker wallet wakes up and moves 25,700 ETH
A wallet linked to the Drift Protocol hack sent about $61 million in Ether to Tornado Cash, a service that hides transaction trails, according to blockchain analytics platform Lookonchain.
Lookonchain said the wallet deposited 25,700 ETH into the mixer over two hours on Tuesday, after two months without activity. The post was published on X.
Despite the transfer, the exploiter's addresses still held about 81,454 Ether, worth roughly $194 million at the time, according to blockchain data platform Arkham.
Key numbers from the transfer
- 25,700 ETH sent to Tornado Cash in about two hours.
- About $61 million in value moved to the mixer.
- About 81,454 ETH, or roughly $194 million, still held by the exploiter's addresses.
- Two months passed between the last wallet activity and this transfer.
What Drift reported about the hack
Drift, a decentralized exchange built on the Solana blockchain, reported about $295 million in losses from the April 1 hack. A decentralized exchange is a trading platform that runs on blockchain software rather than through a central company.
In June, Drift said a forensic investigation by cybersecurity firm Mandiant attributed the attack to UNC6862, a North Korean threat group.
On Oct. 1, Drift opened claims and redemptions for DFX recovery tokens. These tokens give affected users a claim on a recovery pool. That pool held about $3.1 million at launch and receives exchange revenue and any recovered funds, according to Drift.
Where the hack ranks in 2026
The Drift exploit is the third-largest crypto hack of 2026, according to data from DefiLlama. Other notable exploits listed include the $387 million Bitget hack and the $320 million Liquid Network exploit.
What is confirmed
Lookonchain's report of the 25,700 ETH deposit and Arkham's figure for the remaining 81,454 ETH come from blockchain analytics firms rather than from the hacker. Drift has confirmed the size of its losses at about $295 million and said Mandiant's investigation tied the attack to a North Korean group.
Crypto mixers such as Tornado Cash pool funds from many addresses and obscure where the money came from and went, which makes tracing harder. Using a mixer does not by itself prove who controls a wallet.
What is still unclear
The source material does not say whether the transferred funds have been recovered, who exactly controls the wallet, or what the remaining Ether will be used for. It also does not say whether authorities have taken any action in connection with the transfer.
Why it matters
The transfer shows that funds taken in one of 2026's largest hacks are still moving between wallets months after the attack. Drift users affected by the hack can claim DFX recovery tokens, while the recovery pool's value depends partly on funds that are recovered.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.