Drift Exploiter Moves 25,700 ETH Into Tornado Cash After Two Quiet Months

Wallets tied to April's Drift Protocol theft deposited 25,700 ETH into Tornado Cash over two hours on Tuesday, according to Decrypt and Cointelegraph. Roughly 81,000 ETH remains in the attacker's wallets, while Drift's recovery pool has so far paid out only a fraction of user losses.

Two hours of mixer deposits break a two-month silence

Wallets linked to the Drift Protocol exploit moved 25,700 ETH into Tornado Cash on Tuesday, a transfer worth about $61.56 million, according to Decrypt. The deposits arrived over roughly two hours, and the addresses had been inactive for about two months, both Decrypt and Cointelegraph reported.

Decrypt, citing Arkham Intelligence transfer data, said the money went in as batches of 100 ETH, worth about $237,800 each, along with a number of 10 ETH deposits. According to Decrypt, these amounts correspond to the denominations of Tornado Cash's fixed pools. Because every deposit in a pool looks the same, a user can later withdraw to a fresh address, and the public link between sender and receiver is broken.

Cointelegraph credited the on-chain observation to a post by analytics platform Lookonchain on X. It added that mixers pool funds from many addresses, which makes following a trail of stolen money harder for investigators and exchanges.

How the April attack worked and why the loot sits in ETH

The exploit took place on April 1 and hit Drift's vaults on Solana, Decrypt reported. The attacker first obtained admin powers, then added a counterfeit token to the platform and borrowed genuine liquidity against it. Drift's own asset tally totals $295.7 million, with the Jupiter Liquidity Provider token (JLP) accounting for $159.3 million and USDC for $71.4 million. Decrypt reported that most of the USDC was later swapped and bridged to Ethereum.

Drift said the operation ran for six months. According to Decrypt, the attackers presented themselves as a quant trading company, held face-to-face meetings with contributors and put in $1 million of their own funds to gain credibility. Drift said in June that the cybersecurity firm Mandiant had attributed the attack to UNC6862, a North Korean threat group.

Tuesday's deposits are not the first. Decrypt noted that on July 23 and 24 the address labeled Drift Exploiter 4 moved roughly 23,095 ETH, valued at about $44.4 million at that time, through the same mixer. Cointelegraph, citing DefiLlama, ranks the Drift exploit as the third-largest crypto hack of 2026, behind a $387 million Bitget hack and a $320 million Liquid Network exploit.

The numbers that matter

The figures below come from the three outlets and show how much has moved and how much remains.

• 25,700 ETH deposited into Tornado Cash on Tuesday, worth about $61.56 million according to Decrypt.
• 81,454 ETH still held across the attacker's wallets after the deposits, according to both Decrypt and Cointelegraph.
• 71 addresses tracked on Arkham's entity page for the attacker, per Decrypt.
• $295.7 million total taken in April, according to Drift's asset breakdown cited by Decrypt.
• About 299.5 million DFX recovery tokens issued, one for every USDT of verified loss.

Where the outlets' accounts diverge

The outlets agree on the core event but differ on valuation and scope. Decrypt values Tuesday's deposit at about $61.56 million, and Cointelegraph rounds it to about $61 million. The Defiant headlines a lower dollar value for the deposit. Its summary does not explain how that number was reached, so the gap cannot be reconciled from its published text.

The remaining holdings differ as well. Decrypt and Cointelegraph both cite 81,454 ETH, but Decrypt puts it at roughly $198.58 million while Cointelegraph says about $194 million, both attributed to Arkham. The Defiant's summary instead refers to five Etherscan-labeled wallets holding about 84,164 ETH. None of the outlets explains why the ETH totals differ, and the difference in labeling sources is one open question.

Decrypt also adds a detail on the other tokens. The wallets hold around $561.6K in coins such as USDT, USDC, Solana and USDY, and Arkham lists exactly one Fartcoin worth about 15 cents. Decrypt reports that Drift put the Fartcoin taken in April at $4.1 million. CoinGecko prices Fartcoin at $0.149025, consistent with that 15-cent valuation, so the exploiter's Fartcoin position appears to have been sold or moved on.

A recovery pool paying about a penny on the dollar

Drift opened claims on its DFX recovery token on Oct. 1, according to Decrypt. The relaunched exchange now runs as Velocity. The recovery pool held about 3.1 million USDT at launch, a figure Cointelegraph also reports. Against roughly 299.5 million tokens, early redemptions paid about 0.0104 USDT per token.

The pool is designed to grow. Per Decrypt, it receives a daily portion of Velocity's net protocol revenue, ranging from 60% to 90% and increasing as daily revenue rises. Decrypt also reported that Tether has pledged as much as 127.5 million USDT for the relaunch and recovery. Any stolen assets retrieved by way of freezes, the bounty program or law enforcement would be added to the pool as well.

That last point connects to Tuesday's news. Funds that pass through a mixer are harder to freeze or trace, so the deposits raise a question for the recovery effort. The outlets do not say how much of the pool's future depends on recovered assets, and none reports a change to Drift's plans after the transfers.

What to watch after the latest deposits

The first open question is whether the remaining 81,454 ETH follows the same route. Decrypt reported that the wallets had been inactive for about two months before Tuesday's transfers and that Drift Exploiter 4 had previously deposited roughly 23,095 ETH into Tornado Cash on July 23 and 24. Observers can track the labeled addresses on Arkham and Etherscan to see whether further deposits appear.

A second question is whether any withdrawals from the mixer's pools can be linked to the attacker, and whether exchanges or stablecoin issuers act on them. The sources describe no freezes tied to Tuesday's transfers.

For project teams, the episode is a reminder to check how admin permissions and listed collateral are controlled before a protocol is exposed to large pools of liquidity. Readers following Ethereum-based projects can also browse the newly listed Ethereum tokens on Coinvote, where community votes are recorded alongside each project.

Market snapshot

Asset	Price	24h	7d	Market cap
Ethereum (ETH)	$2,441	+2.0%	-2.5%	$298.21 billion
Fartcoin (FARTCOIN)	$0.149025	+5.0%	-8.0%	$149.0 million

CoinGecko data as of 2026-10-21 (UTC); DeFi TVL from DefiLlama: Ethereum $50.19 billion.

On Coinvote

• New Ethereum Tokens Listed Today: 2,926 projects tracked, 1 new listing in 7 days, 56 community votes today.
• Best Ethereum Meme Coins Today: 256 projects tracked, 0 new listings in 7 days, 0 community votes today.

FAQ

How much ETH did the Drift exploiter send to Tornado Cash?

Decrypt and Cointelegraph report that 25,700 ETH, worth about $61 million, was deposited over roughly two hours on Tuesday. The Defiant headlines a lower dollar value without explaining the difference in its summary.

Who is blamed for the Drift Protocol hack?

Drift said in June that forensic firm Mandiant attributed the April 1 attack to UNC6862, a North Korean threat group. Cointelegraph and Decrypt both repeat that attribution, and Decrypt adds that the attackers presented themselves as a quant trading company.

Can Drift users get their money back?

Drift opened claims on its DFX recovery token on Oct. 1, with one token issued per USDT of verified loss. Early redemptions paid roughly 0.0104 USDT per token, and the pool is meant to grow through revenue sharing, Tether support and any recovered funds.

Sources

• Decrypt: Wallet Linked to Drift Exploit Sends $61 Million in Ethereum to Tornado Cash (2026-10-20)
• Cointelegraph: Drift exploiter sends $61M ETH to Tornado Cash, holds $194M (2026-10-20)
• The Defiant: Drift-Linked Wallet Sends $54.8 Million in ETH to Tornado Cash (2026-10-20)
• CoinGecko (market data), DefiLlama (TVL), Coinvote listing and vote data