Drift Protocol exploiter moves $61M in Ether to Tornado Cash mixer

Drift Protocol exploiter — A wallet linked to the $295 million Drift Protocol hack has sent approximately $61 million worth of Ether (ETH) to the Tornado Cash cryptocurrency mixer, resuming activity after two months of dormancy.

According to blockchain analytics platform Lookonchain, the exploiter deposited 25,700 ETH into the privacy-focused service over a two-hour period on Tuesday. The wallet’s remaining holdings are substantial, with Arkham data indicating the addresses still hold roughly 81,454 ETH, valued at approximately $194 million.

The Drift Protocol, a decentralized exchange on Solana, suffered the major exploit on April 1, 2026. A subsequent forensic investigation by cybersecurity firm Mandiant attributed the attack to UNC6862, a North Korean threat group. The incident ranks as the third-largest crypto hack of the year.

Drift opened a claims process for affected users on October 1, issuing DFX recovery tokens that represent a claim on a recovery pool. The protocol continues to operate, with the recovery pool initially funded with $3.1 million and set to receive ongoing exchange revenue and any future recovered funds.