BTC $81,680 
ETH $2,397 
USDT $0.9991 
BNB $730.14 
XRP $1.30 
USDC $0.9999 
SOL $104.38 
TRX $0.3307 
FIGR_HELOC $1.02 
ZEC $1,155 Drift exploiter moves $61.6M in ETH to Tornado Cash after two months
A wallet tied to the April 1 Drift hack sent 25,700 ETH to the mixer, while trackers give differing figures for what remains.
Key takeaways
- The transfer was large. Lookonchain reported 25,700 ETH, worth about $61.56 million, sent to Tornado Cash on October 20.
- Most funds remain. Trackers estimate the exploiter's wallets still hold 81,454 to 81,864 ETH, worth roughly $194 million to $195 million.
- Loss figures differ. Drift reported about $295 million in losses, while Chainalysis estimated $285 million.
What happened
A wallet group linked to the Drift Protocol exploit moved funds again on October 20. Lookonchain reported that the exploiter deposited 25,700 ETH, worth about $61.56 million, into Tornado Cash, ending roughly two months of inactivity.
Earlier monitoring by Onchain Lens identified at least 13,400 ETH, worth around $32 million, moving to the mixer. A separate account reported one wallet depositing 19,600 ETH, worth about $46.81 million, through 196 transactions. The reports describe observations at different times, and the figures should not be added together.
Estimates of what remains also differ. Lookonchain put the wallets at 81,864 ETH, worth about $195 million. Arkham data cited by Cointelegraph put the holdings at about 81,454 Ether, worth roughly $194 million.
First $2.7KLatest $2.4K-11.0% over the period
Points are daily observations, not closing prices.
Why it matters
Tornado Cash pools deposits and lets users withdraw through separate addresses, which makes direct tracing harder. Sending ETH to the service does not show whether the funds were converted to cash, sold on an exchange or recovered.
Drift, a Solana-based decentralized exchange, reported about $295 million in losses from the April 1 hack. Chainalysis estimated losses at $285 million. Drift said a Mandiant investigation attributed the attack to UNC6862, a North Korean threat group.
Drift opened claims and redemptions for DFX recovery tokens on October 1. The tokens give affected users a claim on a recovery pool, which held about $3.1 million at launch and receives exchange revenue and any recovered funds.
Background
The April attack followed months of social engineering, according to Chainalysis. Attackers posed as representatives of a trading firm and exploited Solana's durable nonce feature, which lets pre-signed transactions stay valid until execution.
DefiLlama ranks the Drift exploit as the third-largest crypto hack of 2026. Other notable exploits include the $387 million Bitget hack and the $320 million Liquid Network exploit.
What is still unclear
- The underlying transactions and latest balances could not be independently confirmed from the publicly accessible Arkham wallet tracker.
- Wallet-specific figures cannot establish the exploiter's total remaining assets, because investigators track several addresses and balances change as transfers occur.
Questions readers ask
How much ETH did the Drift exploiter send to Tornado Cash?
Lookonchain reported a deposit of 25,700 ETH, worth about $61.56 million, on October 20. Earlier monitoring by Onchain Lens identified at least 13,400 ETH moving to the mixer.
How much does the Drift exploiter still hold?
Trackers estimate the wallets hold between 81,454 and 81,864 ETH, worth roughly $194 million to $195 million. The figures come from different observations.
How large was the Drift hack?
Drift reported about $295 million in losses from the April 1 hack, while Chainalysis estimated $285 million. DefiLlama ranks it as the third-largest crypto hack of 2026.
Who is behind the Drift exploit?
Drift said a Mandiant forensic investigation attributed the attack to UNC6862, a North Korean threat group. Chainalysis said attackers spent months posing as representatives of a trading firm.
