Wallet Tied to Drift Exploit Moves 25,710 ETH Into Tornado Cash
Exploiter wallet sends 25,710 ETH to Tornado Cash
A wallet that Etherscan labels "Drift Exploiter 5" sent 25,710 ETH into the Tornado Cash mixer on Oct. 20. Tornado Cash is a tool that mixes crypto funds to make their origin harder to trace. The move nearly emptied the address in its first outgoing Ethereum transactions.
The wallet made 258 successful deposits to the Tornado Cash router: 257 deposits of 100 ETH each, followed by a final deposit of 10 ETH. The first deposit was confirmed at 07:08:35 UTC in block 26,232,203, and the last at 09:21:35 UTC in block 26,232,865, so the sequence took 2 hours and 13 minutes.
The address still held about 3.98 ETH on Oct. 20. The deposits were worth about $63.1 million, based on Ethereum's average price of $2,450 as of that date.
Key numbers from the transfer
- 258 deposits into the Tornado Cash router.
- 257 deposits of 100 ETH each, plus one final deposit of 10 ETH.
- 25,710 ETH moved in total, worth about $63.1 million.
- Start at 07:08:35 UTC, finish at 09:21:35 UTC — 2 hours and 13 minutes.
- Roughly 3.98 ETH left in the wallet on Oct. 20.
Drift's account of the April attack
The transfer came more than six months after the April 1 attack. In its April 2 disclosure through Velocity, Drift initially estimated that approximately $280 million had been withdrawn from the protocol.
Drift said the attacker took over its Security Council administrative powers. It said the attacker used durable nonce accounts to pre-sign transactions and delay their execution, gaining unauthorized or misrepresented transaction approvals in advance. At that point, Drift said its investigation had not found a bug in its programs or smart contracts.
An update Drift published on June 4 said the Mandiant investigation it commissioned had attributed the attack to UNC6862, a North Korean threat group.
How recovered funds could reach users
Drift says funds recovered through freezes, its bounty, or law enforcement go into its Recovery Pool, along with a share of the trading platform's net protocol revenue.
Drift opened DFX claims and redemptions on Oct. 1, allocating one DFX for each USDT of verified loss. DFX is a token issued on the platform, and USDT is a stablecoin designed to hold a value near one US dollar. A holder can redeem tokens for USDT at the quoted redemption amount, and the submitted DFX are burned in the same transaction.
One DFX per USDT of loss records the size of a user's claim, while the USDT paid out depends on the redemption quote at the time of exchange. Redeeming swaps the submitted tokens' participation in future pool deposits for the USDT payout quoted at that time; a user who redeems only part of a holding keeps that participation for the DFX retained.
As of Oct. 4, the Oct. 1 quote stood at about 0.0104 USDT per DFX, or close to one cent per USDT lost.
Drift's April 16 update proposed up to $127.5 million from Tether and $20 million from other partners. The package contemplated a revenue-linked credit facility, an ecosystem grant and market-maker loans.
What is confirmed
- A wallet labeled "Drift Exploiter 5" by Etherscan moved 25,710 ETH into Tornado Cash on Oct. 20 across 258 deposits.
- The deposits ran from 07:08:35 UTC to 09:21:35 UTC and were worth about $63.1 million at an average Ethereum price of $2,450.
- Drift disclosed the April 1 attack on April 2, initially estimating about $280 million had been withdrawn.
- Drift's June 4 update said Mandiant attributed the attack to UNC6862, described as a North Korean threat group.
- Drift reported the Oct. 1 quote at about 0.0104 USDT per DFX as of Oct. 4.
What is still unclear
The Oct. 20 transfers show where this wallet's ETH went, but how much stolen money ultimately returns to the Recovery Pool remains unresolved, according to the source.
On-chain analysis profile Lookonchain reported holdings of 81,864 ETH across the exploiter wallets it tracks, a figure that covers a wider set of addresses than the single wallet described here. The source does not explain why the two totals differ.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.
Related Posts
Ethereum Developers Propose Upgrade to Quantum-Resistant Staking
Korea Ranks 12th in Crypto Competitiveness Despite Strong Retail Demand
Circle President Tells Congress Stablecoins Can Strengthen Dollar Dominance
Bitcoin Breakout Faces $47 Billion Hurdle as More Holders Enter Profit
