Mentioned in This Article
1. What did the Drift exploit wallets move on October 20?
Wallets connected to the April 1 attack on Drift Protocol sent 25,700 ETH, worth roughly $61.56 million, into the Tornado Cash mixer on Tuesday, October 20, 2026. The transfers took about two hours and ended a stretch of roughly two months in which the addresses had been inactive. Blockchain analytics firm Arkham Intelligence says the attacker's tracked wallets still hold about $198 million in Ether.
The deposits are the latest chapter in a theft that Drift valued at about $295 million when it happened. The funds were taken from the protocol's vaults on Solana, and much of the proceeds were later converted and moved across to the Ethereum network, where Tornado Cash operates. The new movement suggests the attacker is working through the stolen assets in stages rather than all at once.
Arkham's data shows that the deposits were not made as one lump sum. They arrived as a series of uniform batches, a pattern that matters because of how the mixer is built, and the pace of the transfers points to a deliberate, scripted effort to push a large amount of value through the service in a short window.
2. How the transfers were structured
According to Arkham, most of the Ether went in as 100 ETH batches, each worth about $237,800 at the prevailing price, with smaller 10 ETH chunks filling out the total. Those amounts line up with the fixed denominations of Tornado Cash's deposit pools. The mixer accepts only set sizes, so anyone moving a large balance has to break it into many identical deposits.
The design is what gives the service its value to people who want to hide a trail. After depositing, a user can later withdraw the same amount to a brand-new address, and nothing on the public ledger directly connects the deposit to the withdrawal. The larger the pool of identical deposits from unrelated users, the harder it becomes for investigators to guess which withdrawal belongs to which deposit.
Using fixed pools also leaves a recognizable signature. When a single entity places dozens of identical deposits within a couple of hours, analysts can see the burst clearly even though they cannot see where the money goes next. That visibility is why Arkham was able to describe both the sizes and the timing of the October 20 transfers so precisely.
3. How much does the attacker still hold?
Arkham's entity page for the exploiter tracks 71 addresses. After Tuesday's deposits, those wallets still show 81,454 ETH, valued at about $198.58 million at the prices cited. They also contain roughly $561,600 in other assets, including the stablecoins USDT and USDC, Solana (SOL) and the tokenized yield product USDY.
Put differently, the amount sent to the mixer on Tuesday is a fraction of what remains within reach of the attacker. At current valuations the untouched Ether is more than three times the value of the 25,700 ETH that went into Tornado Cash, which leaves open the prospect of further rounds of deposits in the weeks ahead.
One small discrepancy appears in the holdings data. Arkham lists only a single unit of the Fartcoin memecoin among the exploiter's assets, worth about 15 cents, while Drift has said that around $4.1 million in Fartcoin was taken in April. The gap suggests that tokens of that kind were sold or moved elsewhere at some point after the theft.
4. An earlier round in July
Tuesday's activity was not the first time the attacker used the mixer. On July 23 and 24, a wallet that Arkham labels Drift Exploiter 4 sent about 23,095 ETH, valued at roughly $44.4 million at that time, into the same service. That transfer ended a long quiet period after the April theft.
Taken together, the two rounds amount to about 48,795 ETH sent through Tornado Cash. The July batch was worth less in dollar terms than the October batch, even though it contained a comparable number of coins, which reflects the different Ether prices on the two dates. The pattern of waiting for weeks and then moving large blocks over a short period is common among attackers who expect scrutiny after a major theft.
The gap of about three months between the first theft and the first mixer deposit, and a further gap of roughly two months before the second, shows an attacker willing to wait. Patience of this kind tends to reduce the attention paid by exchanges and monitoring firms, who often relax their watch on a set of addresses when nothing happens for a long time.
5. How was Drift attacked in April?
The April 1 exploit targeted Drift's vaults on the Solana blockchain. According to the account of the attack, the intruder first obtained administrative powers over the protocol, then introduced a fake token and used it to borrow genuine liquidity from the platform. In effect, worthless collateral was accepted as if it had real value, and real assets were drained in exchange.
Drift's breakdown of the haul totals $295.7 million. The largest component was $159.3 million in JLP, the liquidity-provider token issued by the Jupiter exchange aggregator, followed by $71.4 million in the USDC stablecoin. Most of the USDC was later swapped and bridged to Ethereum, which explains why the proceeds are now sitting in Ether wallets that can reach Tornado Cash.
Lending platforms are exposed to this type of attack because they must decide which assets to accept as collateral. If an attacker can alter those permissions or add an asset of their own, the protection that normally limits how much can be borrowed disappears. Gaining administrative control, as occurred here, is therefore among the most damaging ways a protocol can be compromised.
6. Who was behind the attack?
Drift said in April that the operation was a long, patient effort rather than a quick technical raid. By its account, the group spent about six months preparing, presenting itself as a quantitative trading firm. Its members met Drift contributors in person and even deposited $1 million of their own money to build credibility before moving against the protocol.
In June, Drift said that the cybersecurity firm Mandiant had attributed the attack to UNC6862, a North Korean threat group. State-linked hacking teams from North Korea have been tied to a number of the largest crypto thefts in recent years, and investigators generally believe such operations help fund the country's weapons programs. For that reason, laundering routes such as Tornado Cash draw particular interest from law enforcement and sanctions authorities.
The social-engineering element of the case is notable. Placing real capital into a platform and meeting its team face to face is far more costly than the phishing messages typical of earlier incidents, and it shows how far some attackers will go to gain trusted access. It also complicates defence, because the warning signs look like the ordinary onboarding of a legitimate market-making partner.
7. What is happening with victim compensation?
Drift has since relaunched its exchange under the name Velocity. On October 1 the project opened claims for DFX, a recovery token issued to affected users. Each verified loss of one USDT earned one DFX token, and the total issued was about 299.5 million tokens.
The recovery pool held roughly 3.1 million USDT when claims opened. Spread over the tokens issued, early redemptions paid about 0.0104 USDT per token, or about one cent for each dollar lost. The figure is small compared with the size of the theft, and it reflects the fact that the pool starts out thin and is meant to grow over time.
The pool receives a daily share of between 60% and 90% of Velocity's net protocol revenue, with the percentage rising and falling according to the day's revenue. Tether has committed up to $127.5 million in USDT toward the relaunch and the recovery effort. Any money recovered through freezes, a bounty or law enforcement action would also be added to the pool, which is why the movement of the stolen Ether matters to the people waiting for compensation.
8. Why do deposits into Tornado Cash matter?
Once funds enter a mixer and come out of new addresses, tracing them becomes far harder, and the realistic chance of freezing or recovering them falls sharply. Stablecoin issuers and exchanges can block tokens or accounts they identify, but they can only act on funds they can recognize. Each batch sent through the pools is therefore a step away from any hope of recovery.
That is also why analysts follow movements like Tuesday's so closely. Large deposits give an early signal that an attacker is preparing to cash out, and they give exchanges a chance to tighten monitoring on addresses that may later receive the cleaned funds. The roughly $198 million that has not yet moved remains the main prize for anyone hoping to recover assets on behalf of Drift's users.
For the wider industry, the case illustrates a recurring problem. Protocol theft is increasingly the work of organized groups that plan for months, and the proceeds can be moved across blockchains in minutes. Defenders, by contrast, often have only a short window between the theft and the point at which funds disappear into a mixer.
9. What to watch next
The most immediate question is whether the attacker will continue to feed the remaining 81,454 ETH into Tornado Cash. Another large burst would shrink the pool of recoverable assets and would likely be visible on Arkham's tracker within hours. Observers will also watch for withdrawals from the mixer into fresh addresses, and for any attempt to convert the cleaned funds through exchanges.
On the compensation side, the size of the DFX recovery pool will depend on the revenue of the relaunched Velocity exchange and on how much of Tether's commitment of up to $127.5 million is used. Neither Drift nor the analytics firms have announced a date for further payouts, and no recovery of the stolen funds has been reported.