Drift Exploiter Sends 25,700 ETH to Tornado Cash in Two Hours

Wallets tied to the Drift Protocol hack sent 25,700 ETH, about $61.6 million, into the Tornado Cash mixer over two hours on Tuesday. The addresses had been silent for roughly two months. They still hold more than 81,000 ETH.

What happened on Tuesday

According to Lookonchain and Arkham Intelligence, the deposits reached Tornado Cash in batches of 100 ETH (about $237,800 each) and smaller ones of 10 ETH. Those sizes match the service's fixed pools. A mixer pools funds from many addresses, so the owner can later withdraw to a fresh address, and the public link between sender and receiver disappears.

This is the second wave. Arkham logged the first one on July 23 and 24, when an address labeled Drift Exploiter 4 sent about 23,095 ETH into the same mixer, worth roughly $44.4 million then. Tuesday's amount is larger, and it came after a pause of about two months.

What is left on the attacker's addresses

Arkham tracks 71 addresses linked to the attack. Cointelegraph puts the remainder at $194 million and Decrypt at $198 million, the gap depends on the ether price. Another $561,600 or so sits in USDT, USDC, Solana and the USDY token.

• In July, 23,095 ETH went through the mixer.
• On Tuesday, another 25,700 ETH followed.
• The tracked addresses still hold 81,454 ETH.

DefiLlama ranks the Drift hack third among the biggest attacks of 2026. Only the Bitget and Liquid Network breaches caused larger losses.

How the April hack unfolded

The attack on Drift, a decentralized exchange on Solana, took place on April 1. The attackers gained admin rights, minted a fake token and used it as collateral to borrow real liquidity. By Drift's own count, losses came to $295.7 million. The biggest pieces were Jupiter's JLP token at $159.3 million and USDC at $71.4 million. Most of the USDC was later swapped and bridged to Ethereum.

Drift said the preparation took six months. The attackers posed as a quantitative trading firm, met contributors in person and even deposited $1 million of their own to earn trust. In June, Drift reported that Mandiant had traced the attack to UNC6862, a North Korean group.

What users are getting back

Drift opened claims on its DFX recovery tokens on October 1, and the relaunched exchange now runs as Velocity. About 299.5 million tokens were issued, one per USDT of verified loss, and the pool held only $3.1 million at launch, so early redeemers received roughly 0.0104 USDT per token. The pool gets 60% to 90% of Velocity's net revenue every day, and Tether has committed up to 127.5 million USDT.