Drift exploiter sends $61M ETH to Tornado Cash, holds $194M

The biggest surprise is that the exploiter moved only part of its apparent stash. About 25,700 ETH, worth roughly $61 million, went to Tornado Cash after the wallet had been inactive for two months. The transfer revived attention around the Drift Protocol hack.

Lookonchain reported that the deposit happened over two hours on Tuesday. Tornado Cash is a crypto mixer that pools funds and obscures transaction trails. Arkham later estimated that addresses linked to the exploiter still held about 81,454 ETH, worth roughly $194 million.

The remaining balance shows that the movement was not a complete withdrawal. Investigators and victims still face a large pool of potentially recoverable assets, but funds sent through a mixer can become harder to trace. Drift has already created recovery tokens, and recovered funds could flow into that pool.

Tornado Cash is a cryptocurrency mixer, a service designed to obscure the path taken by digital funds. That matters because blockchain transactions are normally recorded publicly, allowing observers to follow transfers between addresses. A mixer makes those links less direct.

The basic mechanism is pooling. Funds from multiple addresses enter a shared system, and later transactions can emerge through different addresses. In the article, the wallet linked to the Drift hack deposited 25,700 ETH to Tornado Cash over two hours. That movement was worth about $61 million.

Mixing does not necessarily remove transaction records, but it makes interpretation and attribution harder. Investigators may have difficulty proving which later funds came from the original wallet. For Drift users seeking recovery, that extra uncertainty can slow tracing, asset identification, and efforts to return stolen cryptocurrency.

The Drift exploit caused about $295 million in losses, making it the third-largest crypto hack of 2026, according to DefiLlama. The scale is much larger than the amount recently moved through the mixer, but both figures show the attack’s continuing financial impact.

The wallet deposited 25,700 ETH to Tornado Cash, worth roughly $61 million. Arkham estimated that exploiter-linked addresses still held about 81,454 ETH, worth roughly $194 million. In simple terms, the reported remaining holdings were more than three times the value sent to the mixer.

These figures describe different parts of the same situation. The hack’s total losses cover the reported damage, while the ETH figures show assets associated with the exploiter. The transfer may complicate tracing, but the large remaining balance means substantial funds were still visible in linked addresses.

When stolen cryptocurrency enters a mixer, the public record becomes harder to interpret. Transactions may remain recorded on the blockchain, but the direct connection between the stolen funds and later movements is obscured. That matters because recovery efforts depend on identifying, tracking, and potentially freezing or reclaiming assets.

The Drift-linked wallet deposited 25,700 ETH into Tornado Cash over two hours. The service pools funds from multiple addresses, so investigators may see deposits and withdrawals without a simple one-to-one path. This creates uncertainty about which later funds originated with the hack.

The consequences are practical for victims. Tracing can take longer, and proving ownership or linking assets to the exploit can become more difficult. Drift’s recovery pool accepts exchange revenue and any recovered funds, so obscured transfers could affect how much eventually becomes available to affected users.

Drift is a decentralized exchange built on Solana, a blockchain network. It reported about $295 million in losses from the April 1 hack. The incident matters because decentralized exchanges use software and blockchain-based systems to manage trading and assets, making security failures financially significant.

The article does not explain the exact vulnerability or method used in the attack. In general, attackers can target flaws in exchange code, transaction logic, or connected systems. Those possibilities are established features of software-based financial platforms, but they should not be treated as the confirmed cause here.

What is confirmed is the result. Drift later opened claims and redemptions for DFX recovery tokens. The tokens give affected users a claim on a recovery pool, which held about $3.1 million at launch and can receive exchange revenue and recovered funds. The specific technical cause remains unstated in the article.

The suspected actor was UNC6862, which Drift described as a North Korean threat group. That attribution matters because it links a major cryptocurrency exploit to an organized threat group rather than leaving the attacker unidentified.

Mandiant conducted the forensic investigation into the attack. Drift said in June that Mandiant’s work attributed the incident to UNC6862. The article does not provide the investigation’s technical evidence, methods, or confidence level, so the attribution is presented as Drift’s reported conclusion.

The identification adds context to the continuing fund movements. The wallet later sent about 25,700 ETH to Tornado Cash, while linked addresses held about 81,454 ETH. Investigators now face both an attributed suspected actor and a large, partly obscured pool of assets connected to the hack.

A blockchain records cryptocurrency transfers in a shared transaction history. Digital addresses send and receive assets, and observers can inspect those movements on the network. This makes activity publicly traceable at the address level, although the article does not explain how addresses connect to real-world identities.

The Drift case shows both sides of that system. Analysts identified a wallet linked to the hack, tracked a deposit of 25,700 ETH, and estimated holdings across exploiter-linked addresses. Those observations came from blockchain analytics platforms including Lookonchain and Arkham.

Privacy-obscuring tools complicate the picture. Tornado Cash pools funds from multiple addresses and obscures transaction trails, making it harder to connect an original transfer with later activity. The records remain important evidence, but the relationships among transactions become less clear, which can hinder investigation and recovery efforts.