The hacker behind the attack on Drift Protocol, a decentralized exchange in the Solana ecosystem, has moved a massive amount of stolen funds once again!
According to on-chain analytics firm Lookonchain, addresses linked to the Drift hack in April this year became active again on October 20 after lying dormant for about two months. Within just two hours, they deposited 25,700 ETH, worth approximately $61.56 million, into the mixer Tornado Cash. More astonishingly, the associated addresses still hold around 82,000 ETH, worth nearly $200 million, indicating that the attackers still control most of the traceable assets.
Source: Lookonchain
Hacker transfers 25,700 ETH in two hours; mixer activity resumes
Lookonchain reported that the funds were deposited into Tornado Cash in multiple transactions over approximately two hours, totaling 25,700 ETH. According to Arkham’s transaction-tracking data, some deposits were made in fixed amounts of 100 ETH or 10 ETH per transaction, in line with Tornado Cash mixer pool deposit denominations.
Tornado Cash makes it more difficult for outsiders to trace the connection between deposits and withdrawals by mixing funds from different addresses. This means that even if the original hacker address is being monitored, it becomes much harder for investigators to track where the ETH goes after it enters the mixer.
However, on-chain data currently confirms only that the funds were deposited into Tornado Cash; it does not mean they have all been successfully withdrawn, converted to cash, or laundered.
After these transfers, addresses associated with the attacker still held 81,864 ETH, worth approximately $195 million at the time. Arkham’s tracking of 71 associated addresses showed that around 81,454 ETH remained in those wallets.
Drift Protocol suffered a major attack on April 1, 2026. According to the asset list released by the project on April 16, approximately $295.7 million in assets were stolen, including liquidity pool token JLP, USDC, Bitcoin, and assets from the Solana ecosystem.
In an investigation report published in June, Drift said cybersecurity firm Mandiant attributed the attack to UNC6862, a threat group linked to North Korea. This is the cybersecurity attribution cited by the project and does not mean the individuals who carried out the attack have been identified.
Victim compensation remains difficult, with the DFX recovery pool starting at just $3.1 million
Compared with the vast assets still held by the hacker, progress in recovering funds for Drift victims remains limited.
According to an October 1 announcement by the Drift Foundation, the platform has opened claims for DFX Recovery Tokens for victims. One DFX is allocated for every 1 USDT lost, for a total issuance of approximately 299.5 million tokens.
However, the recovery pool held only about 3.1 million USDT when it launched. Since the amount of USDT redeemable for each DFX depends on the pool’s balance and the supply of tokens not yet redeemed, the theoretical redemption value of each DFX was initially only about $0.01—far below the original losses.
Drift said it plans to continue replenishing the recovery pool with protocol revenue, partner funds, and recovered stolen assets. However, it remains uncertain whether these funds will arrive as expected.
The latest large-scale transfer of ETH into Tornado Cash once again highlights a major challenge in DeFi hacks: although blockchain transactions can be publicly tracked, tracing stolen funds does not guarantee they can be frozen or recovered. For Drift victims, what really matters is not how much ETH the hacker moves, but how much of the assets can ultimately be returned to the compensation pool.
This article is republished with permission from: (Blockcast)
Original title: (Drift hacker resurfaces after 2 months! $61.56 million in ETH funneled into Tornado Cash in two hours, with nearly $200 million still in hand)
Original author: Anfei
The article “Drift hacker resurfaces after 2 months! More than $20 million in ETH funneled into Tornado, with nearly $200 million still in hand” was first published by “Crypto City”.