A wallet associated with the April 1 Drift Protocol exploit sent approximately $61 million in Ether to Tornado Cash on Tuesday, ending two months of dormancy from the attacker's addresses.
The transfer involved 25,700 ETH deposited into the mixer over a two-hour period, according to blockchain analytics platform Lookonchain. Tornado Cash pools funds from multiple addresses to obscure transaction trails.
The original attack on Drift, a Solana-based DEX, resulted in $295 million in losses. Drift disclosed in June that cybersecurity firm Mandiant attributed the hack to UNC6862, a North Korean threat group.
Addresses linked to the exploiter retain approximately 81,454 Ether—roughly $194 million—according to Arkham.
Drift opened claims and redemptions for DFX recovery tokens on Oct. 1, granting users a claim on a dedicated recovery pool. The pool launched with $3.1 million and is designed to receive ongoing exchange revenue and recovered funds.
The Drift exploit ranks as the third-largest crypto hack in 2026, per DefiLlama data. Other major incidents include a $387 million Bitget hack and a $320 million Liquid Network breach.
