Drift exploit wallet sends $61.5 million in Ethereum to Tornado Cash

On October 20, 2026, an Ethereum wallet tied to the $295.7 million April 2026 Drift Protocol exploit moved 25,700 Ether (worth ~$61.5 million) into Tornado Cash across 258 deposits. Forensic investigations by Mandiant attributed the cyberattack to North Korean threat group UNC6862, following a six-month social engineering scheme. The exploiter still retains roughly 81,454 Ether worth nearly $198 million, leaving affected users facing recovery payouts of approximately one cent per dollar lost.

Deposits of stolen funds into Tornado Cash

• ▪On October 20, 2026, an Ethereum wallet labeled Drift Exploiter 5 deposited 25,700 to 25,710 Ether, valued at $61.5 million to $63.1 million, into Tornado Cash over approximately two hours
• ▪The October 20, 2026 deposits to Tornado Cash from the Drift Protocol exploiter's wallet were made in fixed tranches of 100 Ether and 10 Ether to match mixer pools and obscure the sender's identity
• ▪Chainalysis reported that on April 1, 2026, the Drift Protocol exploiter moved funds from five initial exploit wallets to a single stopover wallet across 13 transactions before depositing into Tornado Cash
• ▪On July 23 and 24, 2026, an address labeled Drift Exploiter 4, linked to the Drift Protocol exploit, deposited 23,095 Ether, valued at approximately $44.4 million, into Tornado Cash

Remaining assets held by the exploiter

• ▪According to Arkham Intelligence data, 71 tracked wallets belonging to the exploiter behind the April 1, 2026 Drift Protocol exploit retain approximately 81,454 Ether, valued between $194 million and $198.58 million
• ▪Beyond Ether, accounts belonging to the exploiter behind the April 1, 2026 Drift Protocol exploit hold roughly $561,600 in stablecoins and alternative crypto tokens including USDT, USDC, Solana, and USDY

Scale of the Drift exploit

• ▪According to DeFiLlama's tracker, the April 1, 2026 Drift Protocol breach was the third-largest crypto exploit of 2026, behind the $387.5 million Bitget exploit and $320 million Liquid Network exploit
• ▪The April 1, 2026 exploit of Drift Protocol resulted in $295.7 million in stolen crypto assets, including $159.3 million in Jupiter Liquidity Provider tokens and $71.4 million in USDC

Method of the April 1 exploit

• ▪Attackers drained Drift Protocol in under 12 minutes by exploiting a code execution vulnerability in developer tooling, using a fake wallet application, and seizing Security Council administrative powers
• ▪The April 1, 2026 attack on Drift Protocol followed a six-month social engineering operation where attackers posed as a quantitative trading firm, deposited $1 million, and met contributors at conferences

Drift Protocol DFX recovery token

• ▪The Drift Protocol DFX recovery pool is backed by daily allocations of 60% to 90% of net protocol revenue from Velocity, alongside frozen law enforcement assets and a Tether funding commitment
• ▪Early redemptions from the Drift Protocol DFX recovery pool on October 1, 2026 paid approximately 0.0104 USDT per DFX token, yielding victims roughly one cent on the dollar
• ▪Drift Protocol launched claims for its DFX recovery token on October 1, 2026, issuing one DFX token per USDT of verified user loss across roughly 299.5 million tokens