Drift Exploiters Move $109M in ETH to Tornado Cash
Wallets linked to the April 1 Drift Protocol exploit deposited 44,510 ETH, worth about $109 million, into Tornado Cash on October 20–21, according to blockchain trackers. The transfers included about 25,710 ETH on Tuesday and 18,800 ETH on Wednesday. Afterward, Arkham-labeled wallets still held approximately 56,569 ETH, valued at $138 million.
The attack on the Solana-based decentralized exchange caused losses of about $295.7 million and ranks among this year’s largest crypto exploits. Drift said Mandiant attributed the attack to North Korean threat group UNC6862. Tornado Cash can make funds harder to trace, but the transfers do not establish that the ETH has been sold or recovered.
Drift opened claims and redemptions for its DFX recovery token on October 1. The pool began with about 3.1 million USDT, with partner commitments and future protocol revenue intended to support further compensation. The latest ETH movement renews attention on the stolen assets and the prospects for victim repayment, while leaving a substantial potential selling overhang.
Bearish
The news is bearish for ETH in the near term because wallets linked to a major exploit still hold a large quantity of ETH, and routing some of it through Tornado Cash may signal efforts to obscure or eventually move the funds. Traders may price in the risk of future selling, adding short-term pressure or volatility. However, transfers to a mixer do not prove that the ETH has been sold, so the actual market impact may be limited unless coins reach exchanges or other liquidity venues.
Longer term, the story is more about security and recovery risk for DeFi than a change in Ethereum’s fundamentals. If the remaining ETH is sold, it could create additional supply pressure; if it remains dormant or is recovered, that pressure could ease. The reported recovery pool and repayment plans may help victims but do not remove the uncertainty around the stolen funds. Overall, the substantial potential supply overhang supports a bearish classification, while on-chain movements and exchange flows will be important indicators to monitor.