Drift exploiter sends $109M in Ether to Tornado Cash in 2 days

Nearly 37% of the funds stolen from Drift were moved into Tornado Cash within two days. Wallets linked to the April exploit transferred 44,510 Ether, valued at about $109 million. The transfers were intended to make the stolen assets harder to trace.

The movement happened in two stages. On Tuesday, the wallets sent about $61 million in Ether. On Wednesday, they transferred another 18,800 Ether, worth roughly $46 million. Blockchain data tracker Onchain Lens reported the combined total, while Arkham tracked the remaining balances.

The transfers did not represent all the suspected stolen funds. After Wednesday’s activity, Drift exploiter-labelled wallets still held 56,569 Ether, worth approximately $138 million. The funds’ movement may complicate recovery and investigation efforts, while Drift’s recovery-token program gives affected users claims on recovered funds and exchange revenue.

Tornado Cash is a cryptocurrency mixer, also called a tumbler. Its purpose is to reduce the visible connection between the address that deposits funds and the address that later receives them. The article identifies it as the destination for $109 million in Ether linked to the Drift exploit.

A mixer generally works by pooling deposits from multiple users and arranging withdrawals to different addresses, often with timing and amounts that make direct matching difficult. Instead of one obvious transfer from a victim-linked wallet to a final recipient, investigators may see several deposits and withdrawals. This can obscure ownership links in the public transaction history.

The blockchain record does not simply disappear. However, analyzing the flow becomes more complex and may require additional data, timing analysis, and wallet clustering. In this case, the article says the Tornado Cash transfers made the funds harder to trace, not impossible to investigate.

The suspected exploiter-linked wallets transferred 44,510 Ether to Tornado Cash over two days. The Ether was worth approximately $109 million at the time of the reported transfers. This was a major movement of assets connected to the Drift hack.

The total came from two separate transfers. On Tuesday, the wallets sent Ether worth about $61 million. On Wednesday, they sent another 18,800 Ether, valued at roughly $46 million. Onchain Lens reported the two-day total, while Arkham provided data on the wallets’ remaining holdings.

The $109 million represented nearly 37% of the approximately $295 million stolen from Drift in April. The wallets still held 56,569 Ether, worth around $138 million, after Wednesday’s transfers. The scale shows that a substantial share of the stolen assets had not yet been moved into the mixer.

A crypto mixer makes investigators’ work more difficult by weakening the visible connection between a known source wallet and a later destination. That matters because blockchain transactions are publicly recorded, but tracing depends on linking addresses and movements with confidence.

In a typical mixing process, deposits from different users are pooled, then withdrawals are sent to separate addresses. Timing, amounts, and multiple transactions can make it unclear which withdrawal corresponds to which deposit. The article describes this effect directly, saying the Tornado Cash transfers made the Drift funds harder to trace.

This does not automatically erase the transaction history or prove that investigators cannot recover the money. It means they may need more sophisticated analysis and outside information. In the Drift case, the linked wallets still held about $138 million after sending $109 million to the mixer, leaving a significant balance outside those transfers.

Drift was a decentralized exchange, or DEX, based on Solana. It reported approximately $295 million in losses from a hack on April 1. A DEX allows cryptocurrency trading through blockchain-based systems rather than describing a traditional bank as the intermediary, but the article focuses on the hack’s financial impact.

The source does not explain exactly how the attacker caused the losses. It only states that Drift reported about $295 million lost in the April 1 hack. It also identifies wallets labelled as connected to the exploiter and tracks their later Ether transfers to Tornado Cash.

The reported loss made the incident this year’s third-largest crypto hack, according to DefiLlama. Drift later opened claims and redemptions for DFX recovery tokens. Those tokens gave affected users claims on a pool launched with about $3.1 million, plus exchange revenue and recovered funds.

Drift’s security consultant, Mandiant, attributed the April attack to a North Korean threat group. This is the article’s stated assessment of who was responsible for the incident. It connects the attribution to the hack that Drift reported as causing about $295 million in losses.

The article does not describe the evidence Mandiant used. It gives no details about malware, wallet analysis, attack infrastructure, communications, or other investigative findings. Therefore, the only stated basis is Mandiant’s attribution in its role as Drift’s security consultant.

The attribution sits alongside continuing efforts to track the stolen assets. Wallets labelled as linked to the exploiter sent 44,510 Ether, worth about $109 million, to Tornado Cash. After those transfers, the wallets still held roughly $138 million in Ether, according to Arkham data.

A blockchain is a shared digital record of transactions. Cryptocurrency wallets hold the credentials needed to authorize transfers, while smart contracts are programs that can execute rules on the blockchain. Together, they let users move assets without asking a conventional bank to process each payment.

For example, a wallet can sign a transaction sending Ether to another address or interacting with a smart contract. The network verifies that authorization and records the transaction on its public ledger. Observers can usually see addresses, amounts, and timing, even though an address may not display a person’s real name.

This structure explains how investigators can follow the Drift funds and how mixers complicate that work. Blockchain trackers identified transfers to Tornado Cash and estimated remaining balances. The article does not explain blockchain mechanics in detail, but it shows both sides: transactions remain recorded, while a mixer can make ownership links harder to establish.