Wallets Tied to April Drift Hack Send 44,510 ETH, About $109 Million, Through Tornado Cash in Two Days

Wallets tied to the April 1 hack of Drift Protocol sent about 44,510 ETH, roughly $109 million, into the Tornado Cash mixer over two days, according to on-chain trackers.

The first tranche moved Tuesday, Oct. 20. The second moved on Wednesday, Oct. 21.

What moved, and when

Onchain Lens put Tuesday's deposit at 25,710 ETH, about $63 million. Lookonchain, which flagged the transfers around 09:25 UTC Tuesday, counted about 25,700 ETH, roughly $61.6 million, sent over about two hours.

Onchain Lens put Wednesday's batch at 18,800 ETH, about $46 million. The deposits came from two addresses: 0xAa843eD65C1f061F111B5289169731351c5e57C1 and 0xD3FEEd5DA83D8e8c449d6CB96ff1eb06ED1cF6C7.

Tuesday's activity was the first from these wallets in about two months, Lookonchain said.

Arkham Intelligence data shows the deposits arrived in batches of 100 ETH, about $2.4 million each, plus smaller 10 ETH batches. Those sizes match Tornado Cash's fixed deposit pools. The design lets a user withdraw from fresh addresses, which breaks the visible link between sender and recipient.

How much is left

The numbers on remaining holdings do not line up.

Arkham counted 71 addresses tied to the attacker holding 81,454 ETH after Tuesday's deposits, about $198.6 million at the time. It also counted roughly $561,600 in other tokens, including USDT, USDC, Solana and USDY. Lookonchain said 81,864 ETH, about $195 million. EmberCN put the figure at 81,454 ETH.

The Defiant, tracking only five Etherscan-labeled wallets, counted about 84,164 ETH.

One tally published after Wednesday's batch estimates the wallets still hold 56,569 ETH, about $138 million. Subtracting Wednesday's 18,800 ETH from Arkham's post-Tuesday balance would leave roughly 62,650 ETH, so the trackers' methods and address lists plainly differ. Whatever the exact figure, well over $100 million in Ether appears to remain in wallets tied to the exploit.

Ether traded around $2,450 to $2,465 in recent hours, per market data.

A second round at the mixer

This is not the wallets' first trip to Tornado Cash. Arkham recorded an address labeled "Drift Exploiter 4" sending about 23,095 ETH, worth around $44.4 million then, to the mixer on July 23 and 24. EmberCN put the July amount at 24,400 ETH.

EmberCN said the attacker converted the stolen assets into 131,564 ETH in early April at an average price of $2,154, worth about $283 million at the time.

No recoveries tied to the latest laundering activity have been reported.

The original theft

Drift is a Solana-based decentralized exchange for perpetual futures. It reported about $295 million in losses from the April 1 exploit.

Drift's own asset breakdown puts the total at $295.7 million. That included $159.3 million in JLP, the Jupiter Liquidity Provider token, and $71.4 million in USDC. Most of it was later swapped and bridged to Ethereum, which explains the Ethereum-based laundering.

DefiLlama ranks it the third-largest crypto hack of 2026, behind the $387 million Bitget hack and the $320 million Liquid Network exploit.

In April, Drift said the attack was a six-month operation. It said the group posed as a quantitative trading firm, met contributors in person and put in $1 million of its own money to build trust.

In June, Drift said the forensic firm Mandiant attributed the attack to UNC6862, a North Korean threat group.

The recovery side

Drift's exchange has restarted under the name Velocity. On Oct. 1 it opened claims for DFX recovery tokens, issued at one token per $1 of verified loss. That comes to about 299.5 million tokens.

The recovery pool launched with about $3.1 million in USDT. That translated to roughly 0.0104 USDT per token for early claimants, about one cent on the dollar.

The pool is set to receive between 60% and 90% of Velocity's daily net protocol revenue, a share that rises as daily revenue grows. Tether has committed to contribute up to 127.5 million USDT to the restart and recovery program. Any stolen funds recovered through freezes, bounties or law enforcement action will also go into the pool.

Even the full Tether commitment would cover less than half the $295.7 million Drift says was taken. The starting pool of $3.1 million was about 1% of it.

What to watch

Tornado Cash withdrawals from fresh addresses are the next thing trackers will look for, since that is where funds would resurface. Whether any of the roughly $109 million moved this week can be frozen, and how much Ether remains in the original wallets, are both open. The answer determines whether the DFX pool grows beyond its one-cent starting payout.