Drift hack recovery faces hurdles as $61.5M enters Tornado Cash

An address linked to the $295 million Drift Protocol heist in April deposited 25,700 Ether (ETH) into the Tornado Cash mixing service on Tuesday, continuing a laundering process investigators have traced back to a state-sponsored organization in North Korea. This is important for the thousands of Drift users who are yet to be paid.

Two hours, 100 ETH at a time

The deposits arrived over the course of about two hours, totaling around $61.56 million during the transfer, according to data from Arkham Intelligence. The wallet had been dormant for about two months prior to this sudden influx.

As per Arkham’s transfer logs, the deposits were made in fixed amounts of 100 ETH ($237,800 each) and smaller chunks of 10 ETH. The fixed deposits correspond with the deposit pools of Tornado Cash, which allow a user to withdraw money at a later stage from a different address without revealing the connection between sender and receiver.

These moves have also been mapped by Chainalysis. In an X post published on Tuesday, the company stated that on April 1, the exploiter had moved the funds from the five wallets used for the exploitation to a single stopover wallet in 13 separate transactions. The exploiter allowed the wallet to remain dormant until the funds were deposited into the mixer in 100 ETH tranches.

It is not the first round of cleaning the funds. An address called Drift Exploiter 4 sent 23,095 ETH (about $44.4 million) to the same mixer on July 23 and 24.

What’s left in the wallets

In light of the deposits made on Tuesday, Arkham continues to track 81,454 ETH worth somewhere around $194 million, according to TFTC. Somewhere around $198.58 million is in the 71 addresses that belong to the hacker. Additionally, these accounts contain around $561,600 worth of USDT, USDC, Solana, and USDY, as well as one Fartcoin worth roughly 15 cents, according to Arkham’s portfolio view.

The Drift Protocol exploiter, who stole over $270M, is moving $ETH to #TornadoCash after 2 months of inactivity.

Over the past 2 hours, the exploiter has deposited 25,700 $ETH ($61.56M) into #TornadoCash and still holds 81,864 $ETH ($195M).

https://t.co/FRtFrS7rew https://t.co/9ISUIlkHvT

— Lookonchain (@lookonchain) October 20, 2026

In the first place, the hack hit a Solana protocol. However, the hacker later used bridge technology to turn the funds into ETH. In accordance with Drift’s asset distribution table, the hacker made off with $295.7 million worth of tokens, of which $159.3 million is JLP (the Jupiter Liquidity Provider Token) and $71.4 million is USDC.

How the attackers got in

According to the post-mortem written by Drift at drift.trade, the attack on April 1 did not exploit any vulnerability in the code, but instead used social engineering methods over six months. TFTC, quoting the same source, indicated how the attackers posed as a trading company and parked $1 million worth of actual money to establish themselves, while also personally meeting Drift contributors at conferences. They exploited a code execution vulnerability through developer tooling combined with a fake wallet application to drain the protocol in less than 12 minutes.

In a June 3rd post about their recovery efforts, Drift stated that according to a Mandiant forensic investigation, the attack was performed by UNC6862, a threat actor from North Korea. Drift cited Mandiant’s statement that there are “direct ties to other state-sponsored actors involved in similar attacks on other platforms.”

A recovery pool against long odds

Drift opened up claims for its DFX tokens on October 1st. The pool had $3.1 million at the time and was set to grow based on any exchange profits and clawbacks. In terms of the $295 million in losses, those who claimed early were looking at just a penny on the dollar.

Around $9.2 million has been frozen by law enforcement, as per TFTC, which is nearly 3 cents on the dollar. Given that $194 million is in the hands of the exploiter and an increasing portion of it has been deposited into Tornado Cash, recovery does not seem very likely. OFAC blacklisted the mixer in 2022, but there is no confirmation of any clawback on a Tornado Cash deposit by a DPRK-linked entity.

The Drift exploit stands as the third-largest crypto hack in 2026 based on the DeFiLlama crypto exploits tracker, behind the $387.5 million Bitget exploit and the $320 million Liquid Network exploit.