Blockchain monitoring accounts reported that wallets linked to the April Drift Protocol exploit resumed moving stolen funds on October 20, depositing approximately 25,700 ETH ($61.56 million) into Tornado Cash over about two hours. Lookonchain said the exploiter still controlled 81,864 ETH worth roughly $195 million. Separate observations from Onchain Lens and Salus reported 13,400 ETH and 19,600 ETH moving to the mixer, respectively, with varying balances due to different observation times and multiple tracked wallets.
The activity follows the April 1 attack on Drift, a Solana-based decentralized derivatives platform, in which attackers socially engineered the protocol’s Security Council, abused Solana’s durable nonce feature, and used a fake CarbonVote Token as collateral to drain assets. Chainalysis initially estimated losses at $285 million, while Drift later published a breakdown of about $295.7 million. Investigators including Chainalysis, Elliptic and Mandiant linked the attack to North Korea-linked group UNC6862.
On October 1, Drift opened claims and redemptions for DFX recovery tokens, issuing one DFX per verified USDT of loss. The recovery pool launched with about 3.1 million USDT, with Tether committing up to $127.5 million and other partners up to $20 million. Claims remain open until January 1, 2028.
The renewed movement of funds into Tornado Cash, a privacy mixer that obscures transaction trails, has raised security and regulatory concerns across the Ethereum and DeFi ecosystem, though deposits to the mixer do not by themselves prove conversion to cash or sale.
