Drift exploit wallets push $61 million in ETH to Tornado Cash

Wallets linked to the April 1 Drift Protocol exploit moved 25,700 Ethereum, worth about $61.56 million, into Tornado Cash on Oct. 20, ending a roughly two-month quiet period. Decrypt reported the deposits, citing Arkham Intelligence transfer data.

The transfers landed in batches of 100 ETH, roughly $237,800 each, plus smaller 10 ETH chunks that match Tornado Cash's fixed deposit pool sizes. A July 23 and 24 round sent about 23,095 ETH, then worth around $44.4 million, into the same mixer. Arkham's 71 tracked addresses still hold 81,454 ETH, about $198 million, plus smaller balances in USDT, USDC, Solana and USDY.

The April 1 attack hit Drift's Solana vaults after the attacker gained admin powers, introduced a fake token and used it to borrow real liquidity. Drift's own tally put the haul at $295.7 million, led by $159.3 million in Jupiter Liquidity Provider tokens and $71.4 million in USDC, much of which was later bridged to Ethereum. Drift has said the operation ran about six months, with the group posing as a quantitative trading firm and depositing $1 million of its own money to build trust with contributors. Mandiant later attributed the attack to threat group UNC6862, a North Korean-linked cluster, according to Decrypt.

Cointelegraph and CryptoSlate reported the same mixer transfers and remaining balance figures. Tornado Cash accepts fixed-size deposits that let users later withdraw from fresh addresses, breaking the public link between sender and receiver. That structure is why batch sizes in the Drift-linked transfers track the mixer's known pool sizes so closely.

Claims for Drift's DFX recovery token opened on Oct. 1, issuing one token per USDT of verified loss, about 299.5 million tokens in total. The pool held roughly 3.1 million USDT at launch, so early redemptions paid about 0.0104 USDT per token. Velocity, the relaunched exchange, routes 60% to 90% of net protocol revenue into the recovery pool daily, and Tether has committed up to 127.5 million USDT toward the recovery. Stolen funds recovered through freezes, the bounty program or law enforcement also flow into the pool.

Tornado Cash remains a primary cash-out path for large ETH balances that cannot move through regulated exchanges without KYC. The mixer's fixed deposit sizes, historically 100 ETH and smaller pools, make transfer patterns easy to fingerprint. That is why the Drift-linked deposits in 100 ETH and 10 ETH batches drew immediate attention from chain analysts even before address labels were applied.

Drift's recovery program depends partly on stolen funds being frozen or recovered. The April attack moved a large share of USDC through bridges to Ethereum and into venues that later froze some accounts. Tether has committed up to 127.5 million USDT toward the relaunch and recovery. Velocity's revenue share into the DFX pool is the ongoing cash-flow component; one-time freezes and law enforcement recoveries are the variable component. Mixer movement of the remaining ETH reduces the chance of future freezes on that portion.

Mandiant's attribution to UNC6862 places the Drift attack in the broader North Korean campaign against DeFi protocols. Drift has described a six-month social engineering operation in which the group posed as a quantitative trading firm, met contributors in person and deposited $1 million of its own capital to build trust before escalating to the vault drain. The Tornado Cash transfers on Oct. 20 are the second mixer round after the July movement of about 23,095 ETH.

Velocity, Drift's relaunched exchange brand, opened DFX claims on Oct. 1 and issues one token per USDT of verified loss. The recovery pool's daily revenue share scales from 60% to 90% of net protocol revenue as daily revenue grows. Early redemptions paid roughly a penny per dollar lost, a reflection of how small the initial pool was relative to total claims. Later distributions depend on sustained trading volume on Velocity and on any additional freezes.

The exploiter's remaining 81,454 ETH across 71 tracked addresses is large enough that further mixer rounds would be visible onchain. Analysts at Arkham and other firms continue to label new addresses as they appear. That labeling is what made the Oct. 20 deposits attributable within hours. Without labels, mixer deposits of this size still attract attention because of batch-size fingerprints.