Wallet Linked to Drift Exploit Sends $61 Million in Ethereum to Tornado Cash

Wallets tied to April’s $295 million Drift Protocol exploit pushed 25,700 Ethereum, worth about $61.56 million, into the crypto mixer Tornado Cash over roughly two hours on Tuesday. The addresses had been quiet for about two months before the burst.

Transfer data from Arkham Intelligence shows the deposits landing in batches of 100 ETH, about $237,800 each, plus smaller 10 ETH chunks. Those sizes match the mixer’s fixed deposit pools, which let users pull funds out later from fresh addresses and break the public link between sender and receiver.

Arkham’s entity page, which tracks 71 addresses linked to the attacker, still shows 81,454 ETH sitting in those wallets after Tuesday’s deposits, worth roughly $198.58 million at current prices. Besides that ETH stash, the wallet holds around $561.6K in other coins like USDT, USDC, Solana, and USDY.

Tuesday’s deposits follow a first round on July 23 and 24, when an address labeled Drift Exploiter 4 sent about 23,095 ETH, then worth around $44.4 million, into the same mixer.

The April 1 exploit hit Drift’s vaults on Solana after the attacker gained admin powers, introduced a fake token and used it to borrow out real liquidity. Drift’s own asset breakdown puts the haul at $295.7 million, led by $159.3 million in JLP—the Jupiter Liquidity Provider token—and $71.4 million in USDC, most of which was later swapped and bridged to Ethereum.

Arkham’s portfolio view still lists exactly one Fartcoin in the exploiter’s holdings, worth about 15 cents, a long way from the $4.1 million in Fartcoin that Drift says was taken in April.

Drift said in April that the attack was a six-month operation in which the group posed as a quantitative trading firm, met contributors in person and deposited $1 million of its own money to build trust. In June, Drift said forensic firm Mandiant attributed the attack to UNC6862, a North Korean threat group.

Drift, whose relaunched exchange now runs as Velocity, opened claims for its DFX recovery token on Oct. 1, issuing one token for every USDT of verified loss, about 299.5 million in total. The recovery pool held about 3.1 million USDT at launch, so early redemptions paid roughly 0.0104 USDT per token, or about a penny on the dollar.

The pool gets a daily cut of between 60% and 90% of Velocity’s net protocol revenue, scaling up as daily revenue grows, and Tether has committed up to 127.5 million USDT toward the relaunch and recovery. Any stolen funds recovered through freezes, the bounty, or law enforcement also go into the pool.