Drift exploiter: $61 million in ETH sent through Tornado Cash
Wallets linked to the Drift exploit sent 25,700 ETH, worth about $61.56 million, into Tornado Cash. Arkham still tracks 81,454 ETH, while reports differ on the attack’s total haul and North Korean attribution.
CryptoMEV Bot Newsroom4 min read
Key takeaways
- Wallets linked to the Drift exploit sent 25,700 ETH, worth about $61.56 million, into Tornado Cash.
- Arkham tracked 71 addresses holding 81,454 ETH worth roughly $198.58 million after the transfers.
- Reports differ on the attack’s total haul and attributed North Korean group.
- Drift’s recovery pool held about 3.1 million USDT when claims opened on October 1.
25,700 ETH enters Tornado Cash
Drift users seeking recovery were already receiving roughly 0.0104 USDT per DFX token, about a penny on each verified dollar lost. Wallets tied to the April exploit then sent 25,700 ETH, worth about $61.56 million, into Tornado Cash over roughly two hours on Tuesday.
Decrypt reported that the transfers arrived in batches of 100 ETH, alongside smaller 10 ETH transfers. Arkham Intelligence tracks 71 addresses linked to the attacker, which still held 81,454 ETH worth roughly $198.58 million after Tuesday’s deposits.
A narrower account from U.Today said an address labeled Drift Exploiter 5 transferred 13,400 ETH, equivalent to approximately $32 million. U.Today cited MistTrack and other analytics platforms that estimated total daily activity across related wallets at up to 25,700 ETH.
Key figures from the reported transfers
| Figure | Reported value |
|---|---|
| ETH transferred on Tuesday | 25,700 ETH |
| Reported value transferred | About $61.56 million |
| Main transfer batch | 100 ETH |
| Tracked attacker addresses | 71 addresses |
| ETH remaining in tracked addresses | 81,454 ETH |
| Reported value of remaining ETH | Roughly $198.58 million |
| July transfer to Tornado Cash | 23,095 ETH worth about $44.4 million |
| Drift recovery pool at launch | About 3.1 million USDT |
Attack totals and attribution differ
Decrypt put the April 1 haul at $295.7 million, led by $159.3 million in JLP and $71.4 million in USDC. U.Today instead reported that the Solana-based exchange lost $285 million in 12 minutes.
The attribution also differs between the reports. Decrypt cited Mandiant’s attribution to UNC6862, described as a North Korean threat group. U.Today cited TRM Labs and Chainalysis and identified the attacker as UNC4736, also known as Citrine Sleet.
Drift said the April attack was a six-month operation in which the group posed as a quantitative trading firm, met contributors in person and deposited $1 million of its own money to build trust. U.Today described the operation as six months long and said the attackers posed as a legitimate venture fund, communicated with developers at international conferences and deposited $1 million into Drift’s pools.
The July activity was the first major transfer into Tornado Cash, according to both reports. Decrypt said an address labeled Drift Exploiter 4 sent about 23,095 ETH on July 23 and 24, while U.Today described a similar mixer transfer worth about $44 million.
The DFX recovery pool remains small
Drift opened claims for its DFX recovery token on October 1, issuing one token for every USDT of verified loss, about 299.5 million tokens in total. The recovery pool held about 3.1 million USDT when claims opened, so early redemptions paid roughly 0.0104 USDT per token.
The pool receives a daily allocation equal to between 60% and 90% of Velocity’s net protocol revenue, with the share increasing as daily revenue grows. Tether also committed up to 127.5 million USDT toward the relaunch and recovery effort.
Any stolen assets recovered through freezes, a bounty or law enforcement are also directed into the recovery pool. U.Today characterized the initial fund as covering about 1% of users’ net losses, while Decrypt’s figures likewise showed 3.1 million USDT against 299.5 million USDT of verified DFX claims.
Traders face a less transparent supply chain
U.Today reported that the withdrawn Ethereum was reaching the market in portions intended to avoid sharp exchange-rate swings and excessive attention to final selling points. The mixers receive 100 ETH tranches, while Decrypt said their fixed deposit pools can let users withdraw funds from fresh addresses and break the public link between sender and receiver.
Arkham’s tracked-address view still provided a visible concentration of 81,454 ETH, although U.Today cited a wider estimate of between 82,000 and 94,000 ETH worth up to $224 million. For on-chain traders following the flows, the site’s Ethereum Arbitrage Bot overview and crypto trading patterns guide provide context for monitoring liquidity and price behavior.
Recovery still has a major backer: Tether committed up to 127.5 million USDT toward the relaunch and recovery pool.
Sources
- Wallet Linked to Drift Exploit Sends $61 Million in Ethereum to Tornado Cash — decrypt.co, 2026-10-20
- Stolen Ethereum (ETH) Appears on Market: $32 Million ... — u.today, 2026-10-20
