A wallet linked to the April 1 Drift Protocol exploit transferred 25,700 Ether—valued at roughly $61 million—to Tornado Cash over two hours on Tuesday, marking the first significant move of stolen assets in two months.
Blockchain analytics platform Lookonchain flagged the transfer. The April 1 attack on the Solana-based DEX extracted approximately $295 million in total losses. Cybersecurity firm Mandiant attributed the hack to UNC6862, a North Korean threat actor, following a June forensic investigation.
Addresses linked to the exploiter still hold approximately 81,454 Ether valued at roughly $194 million, according to Arkham data. The Tornado Cash transfer suggests the attacker is beginning to fragment and launder the stolen funds through mixers that obscure transaction trails.
Drift initiated claims and redemptions for its DFX recovery tokens on Oct. 1. The recovery pool launched with about $3.1 million in assets and receives exchange revenue plus any recovered funds.
The Drift exploit ranks as the third-largest crypto hack of 2026, behind the $387 million Bitget hack and the $320 million Liquid Network exploit, according to DefiLlama.
