Drift Protocol exploiter moves $285 million after months of silence

An exploiter who stole $285 million from Drift Protocol in April has begun moving the funds after four months of silence. Approximately $44.4 million in ETH was sent to the sanctioned mixer Tornado Cash. The attack, attributed by some analysts to North Korean hackers, was a sophisticated social engineering campaign, not a smart contract flaw, and is being tracked by blockchain security firms.

Drift exploiter fund movements

• ▪The wallet, identified as 0xbDdAE987FEe930910fCC5aa403D5688fB440561B, is part of a group of nearly twenty wallets linked to the exploit by Arkham Intelligence.
• ▪An Ethereum wallet associated with the April Drift Protocol hack began moving $285 million in stolen funds after four months of inactivity.
• ▪The exploiter sent approximately $44.4 million, equivalent to 23,095.1 ETH, to the crypto mixer Tornado Cash.
• ▪A small test transaction of 0.85 ETH was also sent to the crypto exchange Bybit.

North Korean hacker attribution

• ▪Multiple blockchain analytics firms have linked the exploit to North Korean state-sponsored hackers, though attribution is not conclusive.
• ▪A 2026 Chainalysis report notes that keeping stolen assets dormant for months before laundering is a pattern associated with North Korean-linked groups.

Social engineering attack method

• ▪Attackers posed as a quantitative trading firm for six months, depositing over $1 million into Drift Protocol to build trust before the attack.
• ▪The attackers inflated the price of a token they created, CarbonVote Token (CVT), and used it as collateral to drain the protocol in 31 withdrawals.
• ▪The $285 million theft was enabled by a social engineering campaign over several months, not a smart contract flaw.
• ▪After compromising developer devices, the attackers obtained pre-signed approvals from two of Drift's five Security Council members.

Tornado Cash laundering tactics

• ▪The exploiter is using Tornado Cash, a crypto mixer under U.S. sanctions since 2022, to launder the stolen funds.
• ▪The funds sent to Tornado Cash were broken into several smaller transactions to obscure their path.

Broader Solana DeFi impact

• ▪At least 20 other Solana-based projects were disrupted as they used Drift's vault structure for yield.
• ▪Drift Protocol is the largest perpetual futures trading platform on the Solana blockchain.
• ▪The hack reduced Drift Protocol's total value locked (TVL) by more than 50%.

Ongoing blockchain tracking efforts

• ▪Analysts use techniques like wallet clustering and cross-chain analysis to trace illicit funds even after they pass through mixers like Tornado Cash.
• ▪Blockchain security firms including PeckShield, Chainalysis, and Elliptic are actively tracking the stolen funds.

1 source