TL;DR
- The Drift Protocol exploiter transferred approximately $61 million in Ethereum to Tornado Cash after two months of inactivity.
- Addresses linked to the hacker still hold around 81,454 ETH, worth approximately $194 million.
- The attack on Drift Protocol resulted in $295 million in losses and was attributed to a North Korean hacking group following an investigation by Mandiant.
The hacker responsible for the Drift Protocol exploit transferred approximately $61 million in Ethereum (ETH) to Tornado Cash, a protocol that obscures transaction trails by mixing cryptocurrencies.
According to blockchain analytics platform Lookonchain, the wallet linked to the attack deposited 25,700 ETH into Tornado Cash over a two-hour period, following approximately two months of inactivity.
Data from Arkham indicates that addresses associated with the attacker still hold 81,454 ETH, worth around $194 million.
Tornado Cash pools funds from different addresses, making it more difficult to identify their origin and trace subsequent transactions.
The Drift Protocol exploiter, who stole over $270M, is moving $ETH to #TornadoCash after 2 months of inactivity.
Over the past 2 hours, the exploiter has deposited 25,700 $ETH ($61.56M) into #TornadoCash and still holds 81,864 $ETH ($195M).https://t.co/FRtFrS7rew pic.twitter.com/9ISUIlkHvT
— Lookonchain (@lookonchain) October 20, 2026
The Hack Was Attributed to a North Korean Group
Drift Protocol is a decentralized exchange built on Solana. The platform suffered an attack on April 1 that resulted in approximately $295 million in losses.
In June, the project reported that a forensic investigation conducted by cybersecurity firm Mandiant had attributed the incident to UNC6862, a threat group linked to North Korea. The attack ranks among the largest cryptocurrency thefts recorded in 2026.
According to DefiLlama, the Drift hack ranks third by total losses, behind the Bitget hack, valued at $387 million, and the Liquid Network exploit, which resulted in $320 million in losses.
Drift Moves Forward With Compensation for Affected Users
On October 1, Drift Protocol opened claims and redemptions for DFX, the tokens created for its recovery program.
These assets give affected users claims on a fund intended to compensate them for part of the losses suffered during the attack. At launch, the recovery fund held approximately $3.1 million.
The mechanism also provides for revenue generated by the exchange and any stolen funds the project manages to recover to be added to the fund.
