Drift Hackers Move $61.6M in ETH to Tornado Cash

Wallets linked to the April 1, 2026 Drift Protocol exploit deposited 25,700 ETH, worth about $61.56 million, into Tornado Cash over roughly two hours. Lookonchain reported that the wallets still held about 81,864 ETH, valued at roughly $195 million, after the transfers; an earlier Arkham-based report put the remaining balance at 81,454 ETH, or about $198 million. The funds had been quiet for around two months, and the deposits followed a previous transfer of about 23,095 ETH to Tornado Cash in July. Mixing can make subsequent flows harder to trace, but does not prove the ETH has been withdrawn or converted to cash. The Drift exploit caused reported losses of about $295.7 million. Drift said the attacker gained administrative powers and used a fake token to borrow real assets. Its June investigation cited Mandiant’s attribution of the attack to North Korea-linked group UNC6862, without identifying the individuals responsible. Recovery for affected users remains limited. Drift’s DFX programme issued one token per USDT of verified losses, but its pool had about 3.1 million USDT when claims opened, compared with roughly 299.5 million DFX tokens issued. Early redemptions were about $0.0104 per DFX. The pool receives a share of revenue from Drift’s relaunched Velocity exchange, while Tether committed up to 127.5 million USDT toward the relaunch and recovery. The transfers highlight the gap between tracking stolen ETH on-chain and recovering funds.