Drift Hacker Moves $61M in ETH to Tornado Cash After 2-Month Pause

October 21, 2026 MM Crypto Team

The attacker behind the $285 million Drift Protocol exploit is moving funds again. On October 20, wallets linked to the hacker transferred approximately 25,700 ETH — worth about $61.6 million — into Tornado Cash, the crypto mixer that obscures transaction trails. The movement is significant not because it changes the original exploit, which has already happened, but because it changes the practical task facing everyone trying to follow the stolen funds. Once funds enter a mixer, the trail that investigators, analysts, and affected users rely on becomes harder to follow, and the question of whether any further funds can be traced or seized becomes more difficult to answer.

Two Months of Silence Broken

The transfers went through in batches of 100 ETH over about two hours, according to Lookonchain observations cited by Cointelegraph. It was the first movement in roughly two months, ending a period of inactivity that began after a similar transfer of 23,095 ETH on July 23. The pattern of the transfers is worth noting because it shows a methodical approach rather than a single, hurried transaction. Moving funds in repeated batches over a period of time can be a way of carrying out a large transfer in stages, and it also creates a series of on-chain records that analysts can observe and report, even if the ultimate destination of the mixed funds is harder to establish.

Despite the movement, blockchain analytics firms estimate wallets tied to the attacker still hold between 81,864 and 84,164 ETH — up to $200 million — remaining frozen but traceable. That estimate is striking because it shows that the October transfers, large as they are, do not account for the whole of the funds linked to the attacker. A substantial balance is still estimated to be held in wallets that analysts can identify and follow, which means that the tracing task is not finished. At the same time, the phrase used in the original report points to a tension that runs through many post-hack cases: funds can be visible on a public blockchain and therefore traceable in principle, while still being difficult to seize or return in practice, especially once some funds have passed through a mixer.

What a Mixer Does, in General Terms

Tornado Cash is described in the original report as a crypto mixer that obscures transaction trails, and that general description helps explain why the October transfers matter. In general terms, a mixer is a tool that pools together funds from many different sources and then allows withdrawals in a way that breaks the direct, easily followed link between a deposit and a withdrawal. On a public blockchain, transactions are normally visible, so an observer can follow funds from one address to another. A mixer is designed to interrupt that visibility by mixing the funds together, so that the path from an original deposit to a later withdrawal is no longer straightforward to reconstruct from the public record alone.

That general explanation does not mean that mixing makes funds invisible in every sense, and it does not mean that investigators have no options. Analysts can still study timing, amounts, patterns, and other clues, and exchanges and other services may be able to act when funds later appear in identifiable places. What mixing does, in practical terms, is raise the difficulty and cost of tracing, and it can reduce the chance that a later holder of the funds can be linked back to the original exploit with confidence. For affected users, that is why a mixer transfer is often reported as a setback for recovery, even when it does not end the investigation. It changes the odds and the workload, rather than closing the case outright.

The April Exploit

In April 2026, hackers drained the Solana-based decentralized derivatives exchange within minutes. Security experts have linked the exploit to North Korea’s state-sponsored Lazarus Group. The attackers converted the stolen Solana assets into stablecoins before moving them to Ethereum through a cross-chain bridge. Each part of that sequence helps explain why the later tracing task has been so complex. A fast drain leaves little time for an emergency response during the attack itself, and the conversion of assets from one form to another, followed by a move across chains, creates additional steps that must be followed one by one.

The reported link to the Lazarus Group also adds a layer of difficulty that goes beyond ordinary tracing. When security experts link an exploit to a state-sponsored group, the implication, in general terms, is that the actors involved may have resources, experience, and methods for obscuring their activity that are not available to a casual attacker. That does not change the facts of the transfers themselves, but it helps explain why investigators and analysts treat the case as a long-term effort rather than a short investigation. It also helps explain why the movement of funds is followed so closely by analytics firms: each new transfer can provide fresh information about behaviour, timing, and method, even when it does not lead directly to recovery.

From Solana Assets to Ethereum

The conversion path described in the original report is worth unpacking in general terms, because it shows how stolen funds can change form without leaving the crypto ecosystem. The attackers converted the stolen Solana assets into stablecoins before moving them to Ethereum through a cross-chain bridge. A stablecoin, in general, is a crypto asset designed to maintain a value linked to another asset, often a traditional currency, which can make it a convenient intermediate step when moving value between systems. A cross-chain bridge, in general, is a mechanism that allows value to move from one blockchain to another, even though the two networks do not naturally share the same ledger.

Recovery Efforts So Far

The Drift Foundation recovered and froze $9.2 million from earlier mixing attempts. On October 1, the protocol launched a recovery program offering DFX tokens redeemable for a share of a Tether-funded recovery pool built from protocol revenues and recovered assets. Those two facts show that recovery has not been a single event, but a continuing effort with more than one strand. The recovery and freezing of funds from earlier mixing attempts shows that some intervention has been possible, even after funds were mixed, which is an important counterpoint to any assumption that mixing automatically makes recovery impossible. At the same time, the amount recovered so far is only one part of a much larger total linked to the exploit, and the original report does not suggest that the recovery effort is complete.

The recovery program launched on October 1 adds a different kind of mechanism. In general terms, offering tokens redeemable for a share of a recovery pool is a way of giving affected users a claim on future recoveries and on revenues set aside for that purpose, rather than promising an immediate, full repayment. The pool described here is built from protocol revenues and recovered assets, and it is described as Tether-funded, which points to a funding arrangement that supports the pool. The original report does not describe the detailed terms of the program, such as eligibility, timing, or the value of any individual claim, and this expansion does not add those details, because they are not contained in the original post. What readers can take from the report is the structure: a program, a token representing a share, and a pool intended to support payments to affected users over time.

Why the New Transfers Matter for Users Waiting on Recovery

For users waiting on recovery payments, the renewed Tornado Cash flows make tracing — and potential seizure — harder. That sentence, from the original report, captures the human impact behind the on-chain figures. For an affected user, the technical question of whether a transaction can be traced is not abstract. It affects whether funds can be identified at an exchange or another service, whether those funds can be frozen, and whether they can eventually be returned through a recovery process. When funds are mixed, each of those steps becomes less certain, and the timeline for any outcome becomes harder to predict.

What to Watch Next, Without Assuming an Outcome

Looking ahead, the facts in the original report point to several areas that readers may reasonably watch, without assuming what will happen in any of them. One is whether further transfers from wallets linked to the attacker are observed, and whether they follow the same pattern of batches and timing as the October transfers. Another is whether analytics firms update their estimates of the balance still held in those wallets, and whether any further funds are reported as recovered or frozen. A third is whether the recovery program launched on October 1 provides further updates about the pool or about payments to affected users. None of those developments is predicted here, because the original report does not predict them, but each would add to the picture that the October transfers have already changed.

Frequently Asked Questions

What happened on October 20?

Wallets linked to the hacker behind the Drift Protocol exploit transferred approximately 25,700 ETH, worth about $61.6 million, into Tornado Cash.

How were the transfers carried out?

The transfers went through in batches of 100 ETH over about two hours, according to Lookonchain observations cited by Cointelegraph.

Was this the first movement of the funds?

No. It was the first movement in roughly two months, ending a period of inactivity that began after a similar transfer of 23,095 ETH on July 23.

How much is still estimated to be held in wallets tied to the attacker?

Blockchain analytics firms estimate wallets tied to the attacker still hold between 81,864 and 84,164 ETH, up to $200 million.

Why do the Tornado Cash transfers matter for recovery?

For users waiting on recovery payments, the renewed Tornado Cash flows make tracing, and potential seizure, harder, because a mixer obscures transaction trails.

Source: Defi-Planet / Bitcoin Foundation

MM Crypto Analysis Web