A wallet associated with the Drift Protocol exploit moved 25,700 ETH to Tornado Cash on Tuesday, valued at approximately $61 million. The transfer came after two months of dormancy from the exploiter's addresses.
Blockchain analytics firm Lookonchain flagged the deposit, which flowed into the mixer over a two-hour window. Addresses linked to the exploiter retain approximately 81,454 ETH (roughly $194 million) across holdings, according to Arkham data.
The April 1 attack on the Solana-based DEX resulted in $295 million in losses. Mandiant attributed the exploit to UNC6862, a North Korean threat group. Drift launched its DFX recovery token program on Oct. 1, offering affected users claims on a recovery pool seeded with $3.1 million and designed to accrue exchange revenue and recovered assets.
The hack ranks as the third-largest crypto exploit of 2026, behind the $387 million Bitget breach and the $320 million Liquid Network attack, per DefiLlama. The migration of stolen capital to tumblers continues to complicate recovery and on-chain forensics across DeFi.
