Drift Exploiter Funnels $109M in Ether to Tornado Cash After Two Months Quiet
Wallets Behind the Drift Exploiter Tornado Cash 109 Million Transfer Wake Up
After roughly two months of silence, the wallets linked to one of 2026’s largest crypto thefts have moved again — and the destination tells its own story. Addresses tied to the April 1, 2026 exploit of Drift Protocol pushed approximately 44,510 ETH, worth about $109 million, into Tornado Cash over two days, October 20 and 21, according to CryptoBriefing, with corroboration from on-chain trackers including Lookonchain and Arkham, plus coverage by CoinCentral, KuCoin, and Grafa.
The movement came in two tranches. The first saw 25,710 ETH — roughly $61 to $63 million — deposited over about two hours on Tuesday, in batches of 100 ETH plus smaller 10-ETH chunks sized to match the mixer’s fixed deposit pools. A second transfer of roughly $46 million followed the next day. The pattern is the textbook signature of Tornado Cash usage: the protocol accepts fixed denominations, so anyone moving serious money must break it into matching chunks — a laborious process that signals deliberate intent.
After the transfers, the wallets still held a substantial remainder. One estimate put the leftover at roughly 56,569 ETH, about $138 million, while Arkham and Lookonchain showed around 81,454 to 81,864 ETH remaining, worth roughly $194 to $198 million. The discrepancy is worth noting: different analytics platforms cluster addresses differently and take readings at different times, so the exact remainder varies by source. What every tracker agrees on is the direction — tens of millions in stolen ether flowing toward the industry’s most notorious mixer.
The timing matters. The addresses had been quiet for about two months, and patience is itself a tactic. Attackers who move funds immediately do so into a market of maximum attention; those who wait let the trail cool and investigators’ resources drift elsewhere.
A Repeat Visit: The July Trip and the $295 Million Original Theft
This was not the exploiter’s first journey to Tornado Cash. In July 2026, roughly 23,095 ETH — about $44 million — took the same route. That earlier deposit now looks like a test run: a smaller amount pushed through first to confirm the pipeline works, followed months later by the far larger transfer. Combined, the attacker has now routed well over $150 million of stolen funds through the privacy protocol.
The underlying theft puts the laundering in context. The April 1, 2026 attack on Drift Protocol — a Solana-based decentralized exchange for perpetual futures and lending — caused total losses of approximately $295 million, making it the third-largest crypto theft of 2026. The exploit was not a smash-and-grab on a code bug; it was the product of months of social engineering. The attackers gradually gained multisignature admin approvals, then exploited Solana’s durable nonce feature — which lets transactions be signed in advance and executed later — to push through approvals for a fake token called CVT, used to withdraw real assets.
Some trackers attribute the operation to UNC6862, a cluster assessed as linked to North Korea. That fits a well-documented pattern: North Korea-linked actors have become the industry’s most prolific thieves, running long social-engineering campaigns, converting stolen assets across chains, and laundering proceeds through mixers. One technical detail explains why an Ethereum-based mixer features in a Solana-born theft: most stolen assets were converted and bridged into ETH on Ethereum afterward — and for all its controversies, Tornado Cash remains the most established mixing venue on Ethereum.
How Tornado Cash Works — and Why Regulators Hate It
Tornado Cash pools deposits from many users and allows withdrawals to entirely new addresses, using zero-knowledge cryptography to break the direct on-chain link between deposit and withdrawal. An observer can see funds went in and funds came out — but cannot definitively connect a particular withdrawal to a particular deposit. For legitimate users, that is financial privacy. For thieves, it is an exit ramp.
That dual-use reality drew the hammer of the US Treasury’s Office of Foreign Assets Control, which sanctioned Tornado Cash in 2022 over North Korea-linked laundering. The sanctions were among the most aggressive actions ever taken against open-source crypto infrastructure, triggering years of legal fallout including court challenges over whether immutable smart contracts can even be sanctioned. The protocol itself has continued operating regardless.
For the Drift exploiter, the value proposition is straightforward: every day the stolen ether sits in known, flagged wallets, it is frozen out of the legitimate economy. Exchanges screen deposits against blacklists, investigators trace flows in real time, and cashing out through regulated channels triggers alarms. Mixing does not make funds “clean” legally — but it fractures the evidentiary chain, making it far harder to prove that any particular ether emerging from the pool is the same value that went in.
The choice also sends a market signal. When attackers send funds to a mixer, they declare that negotiation is over. While stolen funds sit in traceable wallets, victims retain leverage for a bounty deal — return most of the funds for a cut and no further pursuit. Several major 2026 incidents ended that way. Once funds enter Tornado Cash, that leverage largely evaporates.
What This Means for Drift’s Victims and the Recovery Effort
Drift has not been idle since the attack. On October 1, the protocol opened claims for DFX recovery tokens, backed by an initial pool of nearly 3.1 million USDT and partner support including up to $127.5 million from Tether — one of the year’s more ambitious post-exploit recovery programs.
The early results illustrate the brutal arithmetic of exploit recovery. Initial redemptions reportedly paid only about a penny on the dollar. That reflects simple math: a recovery pool measured in the low millions cannot cover losses measured in the hundreds of millions. Recovery tokens are a claim on future value — protocol revenue, partner contributions, clawed-back funds — not an immediate refund.
The October laundering makes the math harder. Every tranche of ether that disappears into Tornado Cash can no longer be frozen, seized, or negotiated back. Investigators will keep monitoring the pools and applying statistical techniques to link deposits and withdrawals — mixer de-anonymization has advanced considerably — but recovery probability drops with each deposit. The two-month quiet period followed by rapid, large-scale mixing suggests a deliberate strategy: wait for attention to fade, then move decisively.
The broader lesson connects to the sector’s 2026 security record: tracked crypto hacks totaled $2.345 billion across 305 incidents, and the Drift case alone accounts for more than an eighth of that. When a single exploit erases nearly $300 million and the proceeds flow through infrastructure sanctioned years ago yet never shut down, the security conversation must move beyond audits. Social engineering — the months-long cultivation of trust behind the Drift theft — targets people, not code, and no formal verification protects against a compromised multisig signer.
The regulatory backdrop is shifting in response. This same week, the UK’s Financial Conduct Authority opened a consultation on DeFi guidance clarifying how operational resilience and financial-crime rules apply to firms touching decentralized protocols. Every nine-figure laundering event strengthens the argument that DeFi’s permissionless architecture needs guardrails legible to law enforcement — and tests whether those guardrails can work without destroying the openness that makes DeFi valuable.
For now, the on-chain record is plain. Roughly 44,510 ETH moved into Tornado Cash in two days. Between $138 million and $198 million in stolen ether remains in the attacker’s wallets, depending on the tracker. And Drift’s users wait on recovery tokens worth a fraction of what they lost. The exploiter chose the mixer over the negotiating table — likely closing the book on any voluntary return.
FAQ
What is Tornado Cash?
A privacy protocol on Ethereum that pools deposits and lets users withdraw to new addresses, breaking the on-chain link between sender and receiver. The US Treasury’s OFAC sanctioned it in 2022 over North Korea-linked laundering, though the sanctions have faced court challenges.
How much did the Drift exploiters move this week?
Approximately 44,510 ETH — about $109 million — over October 20–21, in tranches of roughly $61–63 million and $46 million. This followed a smaller ~$44 million trip to the mixer in July 2026.
What was the original Drift Protocol hack?
On April 1, 2026, attackers stole roughly $295 million from Drift, a Solana-based DEX for perpetual futures and lending — the third-largest crypto theft of 2026. The exploit used months of social engineering to gain multisig approvals and abused Solana’s durable nonce feature; some trackers attribute it to the North Korea-linked cluster UNC6862.
Can the stolen funds still be recovered?
Prospects dim sharply once funds enter a mixer. While the ether sat in traceable wallets, negotiators had leverage for bounty deals. Drift opened DFX recovery-token claims on October 1 with a ~3.1 million USDT pool plus partner support, but early redemptions paid only about a penny on the dollar.
The Drift case is a reminder that in crypto, the theft is only half the story — the other half is the long, patient game of moving the money. Two months of silence, then $109 million into the mixer in 48 hours. The wallets may still hold up to $198 million more, and every future tranche will follow the same well-worn path unless investigators close it first.
Source: CryptoBriefing
Related reading on MM Crypto Analysis Web
- Ethena Earn+ Vault Puts 11x Leverage Behind a 12% Yield Target
- Ibis Onchain Credit Emerges With $250M FalconX Facility
- Phantom Prediction Markets Arrive for US Users Through Kalshi
More in DeFi on MM Crypto Analysis Web.
