TL;DR
- Wallets linked to the Drift exploiter transferred 44,510 ETH, worth about $109 million, to Tornado Cash across October 20 and 21.
- The transfers represented nearly 37% of the $295 million lost in April, while tracked exploiter wallets still held about 56,569 ETH worth $138 million.
- Drift opened recovery claims on October 1, backed by a pool that launched with $3.1 million and receives exchange revenue and recovered assets.
Wallets linked to the Drift Protocol exploiter transferred 44,510 ETH, valued at about $109 million, to Tornado Cash across October 20 and 21. Onchain Lens recorded 25,710 ETH worth roughly $63 million on Tuesday and another 18,800 ETH worth about $46 million on Wednesday. The two-day transfers represent a movement of exploit-linked Ether into the privacy protocol. This Tornado Cash review explains how the protocol obscures links between deposits and withdrawals.
DRIFT EXPLOITER MOVES $109M $ETH TO TORNADO CASH
The Drift Protocol exploiter transferred 44.51K $ETH (~$109.15M) to Tornado Cash over the past two days.
· October 20: 25.71K $ETH (~$63.04M)
· October 21: 18.8K $ETH (~$46.11M)Addresses:… pic.twitter.com/udDVTmEBje
— Onchain Lens (@OnchainLens) October 21, 2026
Exploiter Wallets Still Hold About $138 Million in Ether
The latest deposits account for nearly 37% of the approximately $295 million lost in the April 1 attack. After Wednesday’s transactions, wallets labelled as connected to the Drift exploiter still held about 56,569 ETH, valued near $138 million at that snapshot. Those remaining balances show that a substantial portion of the exploit-linked Ether had not entered Tornado Cash. Similar movements through mixers have remained a recurring issue across crypto security incidents.
Drift, a Solana-based decentralized exchange, reported roughly $295 million in losses from the April exploit. Its security consultant Mandiant later attributed the attack to a North Korean threat group. The attribution concerns the broader attack investigation, while the latest transfer figures come from addresses tracked onchain as belonging to the exploiter. The incident has contributed to broader scrutiny of large crypto hacks in 2026, particularly where stolen assets are converted, bridged or routed through privacy infrastructure.
Depositing Ether into Tornado Cash makes the subsequent path of funds more difficult to trace because the protocol breaks the direct public link between deposit and withdrawal addresses. A mixer deposit, however, does not by itself prove that the assets were sold, converted into fiat or successfully laundered. The distinction matters when assessing market impact: these transactions represent movement into privacy infrastructure rather than confirmed exchange deposits or spot-market sales, even when the originating wallets are associated with stolen funds.
Drift opened claims and redemptions for DFX recovery tokens on October 1, giving affected users a claim on a recovery pool that launched with approximately $3.1 million and is designed to receive exchange revenue and recovered assets. The $109 million moved over the latest two days remains far larger than the recovery pool’s initial balance. The renewed activity follows other cases where dormant exploit-linked wallets have resurfaced and routed Ether through Tornado Cash, including previous Ethereum exploit movements.
