An exploiter who stole $285 million from Drift Protocol in April has begun moving the funds after four months of silence. Approximately $44.4 million in ETH was sent to the sanctioned mixer Tornado Cash. The attack, attributed by some analysts to North Korean hackers, was a sophisticated social engineering campaign, not a smart contract flaw, and is being tracked by blockchain security firms.
Drift exploiter fund movements
- ▪The wallet, identified as 0xbDdAE987FEe930910fCC5aa403D5688fB440561B, is part of a group of nearly twenty wallets linked to the exploit by Arkham Intelligence
- ▪An Ethereum wallet associated with the April Drift Protocol hack began moving $285 million in stolen funds after four months of inactivity
- ▪The exploiter sent approximately $44.4 million, equivalent to 23,095.1 ETH, to the crypto mixer Tornado Cash
- ▪A small test transaction of 0.85 ETH was also sent to the crypto exchange Bybit
North Korean hacker attribution
- ▪Multiple blockchain analytics firms have linked the exploit to North Korean state-sponsored hackers, though attribution is not conclusive
- ▪A 2026 Chainalysis report notes that keeping stolen assets dormant for months before laundering is a pattern associated with North Korean-linked groups
Social engineering attack method
- ▪Attackers posed as a quantitative trading firm for six months, depositing over $1 million into Drift Protocol to build trust before the attack
- ▪The attackers inflated the price of a token they created, CarbonVote Token (CVT), and used it as collateral to drain the protocol in 31 withdrawals
- ▪The $285 million theft was enabled by a social engineering campaign over several months, not a smart contract flaw
- ▪After compromising developer devices, the attackers obtained pre-signed approvals from two of Drift's five Security Council members
Tornado Cash laundering tactics
- ▪The exploiter is using Tornado Cash, a crypto mixer under U.S. sanctions since 2022, to launder the stolen funds
- ▪The funds sent to Tornado Cash were broken into several smaller transactions to obscure their path
Broader Solana DeFi impact
- ▪At least 20 other Solana-based projects were disrupted as they used Drift's vault structure for yield
- ▪Drift Protocol is the largest perpetual futures trading platform on the Solana blockchain
- ▪The hack reduced Drift Protocol's total value locked (TVL) by more than 50%
Ongoing blockchain tracking efforts
- ▪Analysts use techniques like wallet clustering and cross-chain analysis to trace illicit funds even after they pass through mixers like Tornado Cash
- ▪Blockchain security firms including PeckShield, Chainalysis, and Elliptic are actively tracking the stolen funds
Story comments
Loading comments…