Drift Exploiter Sends $61m of ETH to Tornado Cash

A wallet linked to the April hack of Drift Protocol has sent about $61m of Ether (ETH) to the Tornado Cash mixer, Cointelegraph reported on 20 October. The wallet deposited 25,700 ETH over two hours on Tuesday after two months of inactivity, blockchain analytics platform Lookonchain said in an X post cited by Cointelegraph.

The move matters because mixing makes stolen funds much harder to trace, and therefore to freeze or recover, for the users still waiting to be repaid. Drift, a Solana-based exchange, lost about $295m in the 1 April attack, which it says forensic firm Mandiant attributed to a North Korean threat group.

In brief

A wallet tied to the Drift hack sent about $61m of ETH to Tornado Cash, Cointelegraph reports, citing Lookonchain.
Tracker figures differ: The Defiant counted 23,000 ETH, worth about $54.8m.
Drift says Mandiant attributed the $295m April attack to UNC6862, a North Korean group.

Trackers disagree on the size of the move

The figures depend on who is counting and when. The exploiter’s addresses still held about 81,454 ETH, worth roughly $194m, according to Arkham data cited by Cointelegraph. The Defiant, reviewing Ethereum transaction records itself, reported that a wallet flagged by PeckShield deposited 23,000 ETH, worth about $54.8m at the time, and that about 84,164 ETH remained in five wallets Etherscan labels as Drift exploiters.

Measure	Lookonchain / Arkham (via Cointelegraph)	The Defiant
ETH sent to Tornado Cash	25,700 (about $61m)	23,000 (about $54.8m)
ETH still held	About 81,454 (about $194m)	About 84,164 (about $200m)

Sources: Cointelegraph and The Defiant, 20 October 2026.

Drift points to North Korea, via Mandiant

The attribution comes from Drift’s own investigators. In a 3 June update, Drift said “Mandiant’s investigation conclusively attributed the attack to UNC6862, a North Korean threat group”. Drift’s incident accounting puts total losses at $295,706,374.93.

Repayment is under way but small so far. Drift opened claims and redemptions for its DFX recovery tokens on 1 October, and says its recovery pool “holds about 3.1M USDT today”. Cointelegraph, citing DefiLlama, ranks the exploit as the third-largest crypto hack of 2026.

Our read

This is TSN’s analysis, not investment advice. For compliance teams, the gap between trackers is the practical problem: screening that relies on one provider’s figures may miss part of the flow. Exchanges watching for Tornado Cash withdrawals linked to this wallet will need to work from transaction records, not headline totals. Each new hop into a mixer makes the recovery pool’s job harder.