The exploiter behind the April 1 Drift Protocol hack transferred approximately $61 million in Ether to Tornado Cash on Tuesday, moving 25,700 ETH over two hours following two months of dormancy.
Blockchain analytics platform Lookonchain reported the on-chain movement. The exploiter's addresses still hold 81,454 Ether, valued at roughly $194 million.
Drift, a Solana-based DEX, reported $295 million in losses from the April 1 incident. Cybersecurity firm Mandiant attributed the attack to UNC6862, a North Korean threat group, a finding Drift acknowledged in June.
Tornado Cash allows the exploiter to pool their Ether with funds from other addresses, obscuring specific transaction trails for investigators.
Drift launched DFX recovery tokens on Oct. 1, giving affected users a claim on a dedicated recovery pool. The pool began with approximately $3.1 million and is structured to receive ongoing exchange revenue and any recovered funds.
According to DefiLlama data, the Drift exploit ranks as the third-largest crypto hack in 2026, behind the $387 million Bitget hack and the $320 million Liquid Network exploit.
