April

Tornado

Tornado Cash

Drift

Cash

<p>A wallet group linked to the $285 million Drift Protocol exploit has resumed moving stolen cryptocurrency, with blockchain analysts reporting that approximately $61.56 million in Ethereum was deposited into Tornado Cash on October 20.</p>
<div id="cn-block-summary-block_d1a124531925810b117c6b7b3e41f191" class="cn-block-summary">
 <div class="cn-block-summary__nav tabs"><span>Summary</span>
 </div>
 <div class="cn-block-summary__content">
  <ul>
   <li>Lookonchain reported that the Drift exploiter deposited 25,700 ETH, worth approximately $61.56 million, into Tornado Cash on October 20.</li>
   <li>Earlier monitoring by Onchain Lens identified at least 13,400 ETH, worth around $32 million, moving to the mixer.</li>
   <li>The transfers follow an April 1 attack that Chainalysis estimated caused $285 million in losses.</li>
   <li>Drift said a subsequent forensic investigation attributed the attack to a North Korea-linked group.</li>
   <li>The protocol opened DFX recovery-token claims and redemptions for affected users on October 1.</li>
  </ul>
 </div>
</div>
<p>According to blockchain monitoring account Lookonchain, the suspected exploiter <a href="https://x.com/lookonchain/status/2112475259907846217" rel="noopener noreferrer nofollow">transferred</a> 25,700 ETH into the privacy-focused mixing service over a two-hour period, ending roughly two months of reported inactivity. The tracker estimated that the wallets still controlled 81,864 ETH worth approximately $195 million.</p>
<figure class="wp-block-embed is-type-rich is-provider-x wp-block-embed-x">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>The Drift Protocol exploiter, who stole over $270M, is moving <a href="https://x.com/search?q=%24ETH&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$ETH</a> to <a href="https://x.com/hashtag/TornadoCash?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#TornadoCash</a> after 2 months of inactivity.<br><br> Over the past 2 hours, the exploiter has deposited 25,700 <a href="https://x.com/search?q=%24ETH&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$ETH</a> ($61.56M) into <a href="https://x.com/hashtag/TornadoCash?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#TornadoCash</a> and still holds 81,864 <a href="https://x.com/search?q=%24ETH&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$ETH</a> ($195M).<a href="https://t.co/FRtFrS7rew" rel="noopener noreferrer nofollow">https://t.co/FRtFrS7rew</a><a href="https://t.co/9ISUIlkHvT" rel="noopener noreferrer nofollow">pic.twitter.com/9ISUIlkHvT</a></p>— Lookonchain (@lookonchain) <a href="https://x.com/lookonchain/status/2112475259907846217?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 20, 2026</a>
  </blockquote>
 </div>
</figure>
<p>An earlier Onchain Lens update <a href="https://x.com/OnchainLens/status/2112461627039912380" rel="noopener noreferrer nofollow">identified</a> at least 13,400 ETH, valued at roughly $32 million, flowing into Tornado Cash. Its accompanying wallet snapshot showed approximately $224.59 million in remaining assets.</p>
<p>Meanwhile, the two trackers reported different amounts as the transfers unfolded. The latest wallet balances have yet to be independently verified <a href="https://arkm.com/explorer/entity/drift-protocol-exploiter" rel="noopener noreferrer nofollow">through</a> Arkham.</p>
<h2 class="wp-block-heading" id="strong-drift-exploiter-resumes-tornado-cash-transfers-strong"><strong>Drift exploiter resumes Tornado Cash transfers</strong></h2>
<p>The reported activity represents another stage in the movement of assets taken from Drift, a Solana-based decentralized derivatives platform.</p>
<p>Tornado Cash pools cryptocurrency deposits and allows funds to be withdrawn through separate addresses, making direct transaction tracing more difficult. Sending ETH to the service does not establish whether the funds were converted into cash, sold on an exchange or recovered by another party.</p>
<p>You might also like: <a href="https://crypto.news/drift-exploiter-moves-44m-through-tornado-cash-after-months/" rel="noopener noreferrer nofollow"> Drift exploiter moves $44M through Tornado Cash after months </a></p>
<p>A separate monitoring account reported that one wallet deposited 19,600 ETH, worth approximately $46.81 million, through 196 transactions on October 20. That figure falls between the two social-media observations but has not been reconciled against a complete transaction-level record.</p>
<figure class="wp-block-embed is-type-rich is-provider-x wp-block-embed-x">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>The Drift Protocol exploiter deposited 19,600 ETH (~$46.81M) into Tornado Cash in 196 transactions on October 20, 2026, moving funds held for roughly 202 days, according to the our Tornado monitoring system.<br><br> On April 1, the Solana perpetuals platform suffered an estimated $285M… <a href="https://t.co/OEjYr8uRzQ" rel="noopener noreferrer nofollow">https://t.co/OEjYr8uRzQ</a><a href="https://t.co/sXaSkLDsRe" rel="noopener noreferrer nofollow">pic.twitter.com/sXaSkLDsRe</a></p>— Salus (@salus_sec) <a href="https://x.com/salus_sec/status/2112473068044157202?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 20, 2026</a>
  </blockquote>
 </div>
</figure>
<p>The same account identified a wallet ending in 57c1 that had reportedly held stolen assets since April. It estimated the address retained 6,114.15 ETH, valued near $14.6 million, after its first outgoing transactions.</p>
<p>These wallet-specific figures cannot establish the exploiter’s total remaining assets because investigators track several addresses and the balances change as transfers occur.</p>
<h2 class="wp-block-heading" id="strong-april-drift-exploit-followed-months-of-social-engineering-strong"><strong>April Drift exploit followed months of social engineering</strong></h2>
<p>The original attack took place on April 1, when attackers obtained administrative control of Drift through transaction approvals from members of its Security Council.</p>
<p>In an April 9 <a href="https://www.chainalysis.com/blog/lessons-from-the-drift-hack/" rel="noopener noreferrer nofollow">investigation</a>, Chainalysis estimated losses at $285 million, representing more than half the protocol’s total value locked.</p>
<p>The attackers reportedly spent months posing as representatives of a trading firm and building relationships with Drift contributors. They exploited Solana’s durable nonce feature, which permits pre-signed transactions to remain valid until execution.</p>
<p>After obtaining sufficient multisignature approvals, the attackers took control of administrative permissions and approved a fake token called CarbonVote Token, or CVT, as collateral.</p>
<p>According to Chainalysis, the attackers manufactured trading activity around CVT to create an artificial price history. They then used the token as collateral to withdraw genuine assets, including stablecoins and cryptocurrencies.</p>
<p>Subsequently, Drift published a more detailed <a href="https://www.drift.trade/updates/incident-recovery-update-april-16-2026-now" rel="noopener noreferrer nofollow">asset breakdown</a> totaling approximately $295.7 million in stolen tokens. The figure differs from the initial forensic estimate because the reports use different valuations and accounting scopes.</p>
<p>Investigators traced portions of the proceeds moving between Solana and Ethereum, where the attacker accumulated ETH before the latest reported mixing activity.</p>
<h2 class="wp-block-heading" id="strong-investigators-linked-the-attack-to-north-korean-operators-strong"><strong>Investigators linked the attack to North Korean operators</strong></h2>
<p>Security researchers have connected the Drift theft to a suspected North Korean hacking operation.</p>
<p>In an April 7 <a href="https://www.elliptic.co/insights/drift-protocol-exploited-for-286-million-in-suspected-dprk-linked-attack/" rel="noopener noreferrer nofollow">assessment</a>, blockchain analytics company Elliptic identified transaction patterns and laundering techniques consistent with earlier North Korea-linked attacks.</p>
<p>Drift later reported that an investigation by cybersecurity firm Mandiant had attributed the incident to UNC6862, a North Korean threat group.</p>
<p>The platform had previously <a href="https://crypto.news/drift-links-280m-hack-to-radiant-attackers/" rel="noopener noreferrer nofollow">linked the attack</a> to the operators behind Radiant Capital’s October 2024 exploit. Radiant suffered losses estimated at approximately $50 million in that incident.</p>
<p>The case was part of a series of major DeFi thefts in April. As crypto.news previously reported, <a href="https://crypto.news/crypto-hacks-top-600m-in-april-as-market-prices-in-security-tax/" rel="noopener noreferrer nofollow">April exploit losses exceeded $600 million</a> during the month’s first 18 days, including separate attacks on Drift and KelpDAO.</p>
<h2 class="wp-block-heading" id="strong-drift-recovery-claims-opened-in-october-strong"><strong>Drift recovery claims opened in October</strong></h2>
<p>While investigators continued tracing the stolen cryptocurrency, Drift established a program to compensate affected users.</p>
<p>On October 1, the project opened claims and redemptions for DFX recovery tokens. Its announcement <a href="https://www.drift.trade/updates/dfx-claim-and-redemptions" rel="noopener noreferrer nofollow">stated</a> that each verified USDT of loss entitled an affected user to one DFX token.</p>
<p>The protocol fixed the total token supply at approximately 299.5 million and said its recovery pool contained around 3.1 million USDT at launch.</p>
<p>Users can redeem DFX against available pool funds, trade the tokens or retain them while additional funds accumulate. The redemption amount depends on the pool balance and outstanding token supply, so holding a DFX token does not guarantee immediate repayment at face value.</p>
<p>The project said proceeds from its relaunched trading platform, Velocity, would contribute to the recovery pool. Tether has separately committed up to $127.5 million in support, while other partners have committed up to $20 million.</p>
<p>Drift’s October announcement states that funds recovered through enforcement action, freezing or other recovery efforts will be added to the pool. DFX claims remain open until January 1, 2028.</p>
<p>Read more: <a href="https://crypto.news/top-uk-banks-including-lloyds-barclays-are-restricting-crypto-related-transfers-report/" rel="noopener noreferrer nofollow"> Top UK banks including Lloyds, Barclays are restricting crypto related transfers: report </a></p>

Drift exploiter resurfaces after 2 months, moves $61.6M in ETH to Tornado Cash

Table of Contents

crypto.news

Other articles published on Oct 20, 2026

Join our free newsletter for daily crypto updates!